echo[.]7z | Triage™

resource	yara_rule
static1/unpack001/ollydbg/Plugins/idaficator.dll	acprotect

resource	yara_rule
static1/unpack001/ollydbg/Plugins/idaficator.dll	upx

resource
unpack001/1058352281.exe
unpack001/echo/EchoMirage.exe
unpack001/echo/EchoMirageHooks32.dll
unpack001/echo/EchoMirageHooks64.dll
unpack001/echo/EchoMirageUnelevated.exe
unpack001/echo/unins000.exe
unpack001/ollydbg/OllyDbg.exe
unpack001/ollydbg/OllyPath.dll
unpack002/bin/OllyPath.dll
unpack001/ollydbg/Plugins/Asm2Clipboard.dll
unpack001/ollydbg/Plugins/ClearUDD.dll
unpack001/ollydbg/Plugins/CmdBar.dll
unpack001/ollydbg/Plugins/DataRipper.dll
unpack001/ollydbg/Plugins/HiddenThreads.dll
unpack001/ollydbg/Plugins/ICanAttach2.dll
unpack001/ollydbg/Plugins/MnemonicHelp.dll
unpack001/ollydbg/Plugins/ModuleBCL.dll
unpack001/ollydbg/Plugins/ODBJscript.dll
unpack001/ollydbg/Plugins/ODbgScript.dll
unpack001/ollydbg/Plugins/OllyCopy.dll
unpack001/ollydbg/Plugins/OllyFlow.dll
unpack001/ollydbg/Plugins/OllyWow64_0.2.dll
unpack001/ollydbg/Plugins/RemoveCriticality.dll
unpack001/ollydbg/Plugins/SehSpy.dll
unpack001/ollydbg/Plugins/SigMaker.dll
unpack001/ollydbg/Plugins/StollyStruct.dll
unpack001/ollydbg/Plugins/StrongOD.dll
unpack001/ollydbg/Plugins/TLSCatch.dll
unpack001/ollydbg/Plugins/X_CRYPTO.dll
unpack001/ollydbg/Plugins/analyzeThis.dll
unpack001/ollydbg/Plugins/ida_sigs.dll
unpack001/ollydbg/Plugins/idaficator.dll
unpack004/out.upx
unpack001/ollydbg/Plugins/multiasm_odbg.dll
unpack001/ollydbg/Plugins/oDump.dll
unpack001/ollydbg/dumpsig.exe
unpack001/ollydbg/loaddll.exe
unpack001/ollydbg/wingraph32.exe

echo.7z

SHA256 4b246be91cb37f662827dbfb616b3a0cea66c9ee8db0eeff3808bf057b2b4738
MD5 e0499900323a2a13e715c79df240c8cc
SHA1 aab068f2af116efa533c46e42424f16f3eef90b6
SHA512 f3b2d599431082f4a0591888ba12ccbf9dd518da64004092ee8dbe8fbff75fadee119694b766dff8cfcebb722600b46b950134304ead0d05069ad588a82d0cfb
SSDEEP 393216:URxIrNnI6f7uzW4RyQZecNoTyBNoQKwKhGM4/kOh3Kv:qI6qqzW4RyncN2wNRKoM4de
MD5 SHA1 SHA512 SSDEEP

1058352281.exe

IMPHASH 41aa9a1f4bf6f9462a4e644e00d744cd
SHA256 147526e215dce704e9a70ba57ec84ec593204c8427565c2848249b8a3ff8a208
MD5 08db896a19a103730f5d4d9b495c1e87
SHA1 c1ff39e34372970533ecfff4444ddf43f37069ae
SHA512 e5f82b1091786c5d03144202cc1efc56f3c1830c495d0d6c548b06acda20661af70f7413ed406e0c8a068df155adc761e8f9911e575a6d0d609ede539809d9eb
SSDEEP 196608:MBXXgnjUvJUivBeENSHgBdbWts3KPgyt3WxS:oXXxZkExj3KPgeh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12111872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

echo/EchoMirage.chm

SHA256 f74e934541bcfd7528cfb143dac6b65afe9986bbcc7ae566a207957b372d999e
MD5 f2983f8dbab743cae54a7c45ca96a56d
SHA1 197935fe5be692fd404a25d4c5463c2a4396974d
SHA512 3521bbeebfcefa0996a2c5e7e2586cd3cdc4724b235c147649796c45797e7f51163844d27ffce0e57c5d286c0f7f408eb42d77dd5b727e249a4a630af1bd7e40
SSDEEP 1536:ArqkXEMuS7YCtHsBIl4ZPrjTKyhFV2Wpjksy:cqOuSxtMBIujua9W
MD5 SHA1 SHA512 SSDEEP

echo/EchoMirage.exe

IMPHASH 00487aa74c91a4dc86982f2621e35a8b
SHA256 d10ad92caff49ee4737a577b72e7647d0d3d06a4feb7d515ec44a6163edcab2e
MD5 b859c2f0ed7bea595f632163f78a3b9e
SHA1 ff171191ce3d405db917b652f8b0a502f6a66f11
SHA512 83a4a2f4f68c30dd4c298ba57666c85fec84102ff794c0388bea79aa972c31b1f2de43f60e27f46f807867f5601c8b35aba6eaaf734074f183c99fa4d37b2ac5
SSDEEP 49152:7s101JJbzp8nSK7PkCPFz2dKS7rM09R2FOXhlLPnH+B0e395ZTmShvL:B/DCdYtLP+DhvL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

5323776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo VariantInit SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl RegUnLoadKeyW RegSetValueExA RegSetValueExW RegSaveKeyW RegRestoreKeyW RegReplaceKeyW RegQueryValueExA RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExA RegOpenKeyExW RegLoadKeyW RegFlushKey RegEnumValueW RegEnumKeyExW RegDeleteValueA RegDeleteValueW RegDeleteKeyW RegCreateKeyExA RegCreateKeyExW RegConnectRegistryW RegCloseKey OpenProcessToken LookupPrivilegeValueA InitializeSecurityDescriptor GetUserNameA GetUserNameW GetTokenInformation GetLengthSid FreeSid AllocateAndInitializeSid AdjustTokenPrivileges GetKernelObjectSecurity

user32

MessageBoxA CharNextW LoadStringW SetWindowLongPtrA GetWindowLongPtrA SetClassLongPtrW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW CreateWindowExA CreateWindowExW WindowFromPoint WaitMessage ValidateRect UpdateWindow UnregisterClassW UnionRect UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu ToAscii SystemParametersInfoW SubtractRect ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextA SetWindowTextW SetWindowPos SetWindowPlacement SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetKeyboardState SetForegroundWindow SetFocus SetCursorPos SetCursor SetClipboardData SetCaretPos SetCapture SetActiveWindow SendMessageTimeoutA SendMessageTimeoutW SendMessageA SendMessageW ScrollWindowEx ScrollWindow ScrollDC ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassA RegisterClassW RedrawWindow PtInRect PostThreadMessageA PostThreadMessageW PostQuitMessage PostMessageA PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect OemToCharBuffW OemToCharA NotifyWinEvent MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxA MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LockWindowUpdate LoadStringW LoadKeyboardLayoutW LoadImageA LoadImageW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDlgButtonChecked IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild IsCharAlphaNumericW IsCharAlphaW InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextA GetWindowTextW GetWindowRect GetWindowPlacement GetWindowDC GetUpdateRect GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetScrollBarInfo GetPropW GetParent GetWindow GetMessageTime GetMessagePos GetMessageExtraInfo GetMessageA GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDoubleClickTime GetDlgItem GetDlgCtrlID GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardFormatNameW GetClipboardData GetClientRect GetClassNameA GetClassNameW GetClassInfoExW GetClassInfoW GetCaretPos GetCapture GetAsyncKeyState GetActiveWindow FrameRect FindWindowExW FindWindowA FindWindowW FillRect EnumWindows EnumThreadWindows EnumClipboardFormats EnumChildWindows EndPaint EndMenu EndDeferWindowPos EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextA DrawTextW DrawStateW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DestroyCaret DeleteMenu DeferWindowPos DefWindowProcA DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CreateCaret CreateAcceleratorTableW CountClipboardFormats CopyImage CopyIcon CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CheckDlgButton CharUpperBuffW CharUpperW CharToOemBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BringWindowToTop BeginPaint BeginDeferWindowPos AttachThreadInput CharLowerBuffA CharLowerA CharUpperA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout EnumDisplayMonitors GetMonitorInfoW MonitorFromPoint MonitorFromRect MonitorFromWindow

kernel32

Sleep VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW lstrcpynW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary lstrlenA lstrlenW lstrcpynW lstrcpyA lstrcpyW lstrcmpiW lstrcmpA lstrcmpW lstrcatW WriteProcessMemory WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx WaitForMultipleObjects VirtualQueryEx VirtualQuery VirtualProtectEx VirtualProtect VirtualFree VirtualAlloc UnmapViewOfFile TryEnterCriticalSection TerminateThread TerminateProcess SystemTimeToFileTime SwitchToThread SuspendThread Sleep SizeofResource SetUnhandledExceptionFilter SetThreadPriority SetThreadLocale SetLastError SetFilePointer SetFileAttributesA SetFileAttributesW SetEvent SetErrorMode SetEnvironmentVariableW SetEndOfFile ResumeThread ResetEvent RemoveDirectoryA RemoveDirectoryW ReleaseSemaphore ReleaseMutex ReadProcessMemory ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent OpenProcess OpenFileMappingA OpenFileMappingW OpenEventA OpenEventW MultiByteToWideChar MulDiv MoveFileW MapViewOfFile LockResource LocalSize LocalFree LocalAlloc LoadResource LoadLibraryExA LoadLibraryA LoadLibraryW LeaveCriticalSection LCMapStringW IsValidLocale IsBadReadPtr InitializeCriticalSection GlobalUnlock GlobalSize GlobalMemoryStatus GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetWindowsDirectoryA GetWindowsDirectoryW GetVersionExA GetVersionExW GetVersion GetTimeZoneInformation GetTickCount GetThreadPriority GetThreadLocale GetThreadContext GetTempPathA GetTempPathW GetSystemTime GetSystemInfo GetSystemDirectoryA GetSystemDirectoryW GetStdHandle GetProcAddress GetModuleHandleA GetModuleHandleW GetModuleFileNameA GetModuleFileNameW GetLocaleInfoA GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileTime GetFileSize GetFileAttributesA GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetDiskFreeSpaceA GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryA GetCurrentDirectoryW GetComputerNameA GetComputerNameW GetCommandLineA GetCommandLineW GetCPInfoExW GetCPInfo GetBinaryTypeW GetACP FreeResource FreeLibrary FormatMessageA FormatMessageW FlushInstructionCache FindResourceA FindResourceW FindNextFileA FindNextFileW FindFirstFileA FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime ExpandEnvironmentStringsA ExpandEnvironmentStringsW ExitThread ExitProcess EnumSystemLocalesW EnumResourceNamesW EnumCalendarInfoW EnterCriticalSection DuplicateHandle DeviceIoControl DeleteFileA DeleteFileW DeleteCriticalSection CreateThread CreateSemaphoreW CreateRemoteThread CreateProcessA CreateProcessW CreatePipe CreateMutexA CreateMutexW CreateFileMappingA CreateFileMappingW CreateFileA CreateFileW CreateEventA CreateEventW CreateDirectoryA CreateDirectoryW CopyFileA CopyFileW CompareStringW CloseHandle Beep Sleep MulDiv GetSystemWow64DirectoryW OpenThread

msimg32

TransparentBlt GradientFill AlphaBlend

gdi32

UnrealizeObject TextOutA TextOutW StretchDIBits StretchBlt StartPage StartDocA StartDocW SetWindowOrgEx SetWindowExtEx SetWinMetaFileBits SetViewportOrgEx SetViewportExtEx SetTextCharacterExtra SetTextColor SetStretchBltMode SetROP2 SetPixel SetMapMode SetEnhMetaFileBits SetDIBits SetDIBColorTable SetDCPenColor SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette Polyline Polygon PolyPolyline PolyBezierTo PolyBezier PlayEnhMetaFile Pie PatBlt OffsetRgn MoveToEx MaskBlt LineTo LPtoDP IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetViewportOrgEx GetTextMetricsA GetTextMetricsW GetTextFaceA GetTextExtentPointW GetTextExtentPoint32A GetTextExtentPoint32W GetTextColor GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectA GetObjectW GetNearestPaletteIndex GetMetaFileBitsEx GetMapMode GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetCurrentPositionEx GetCurrentObject GetClipBox GetCharABCWidthsA GetCharABCWidthsW GetBrushOrgEx GetBkColor GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExtFloodFill ExtCreateRegion ExtCreatePen ExcludeClipRect EnumFontsW EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgnIndirect CreateRectRgn CreatePenIndirect CreatePen CreatePatternBrush CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateFontA CreateFontW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW CombineRgn Chord BitBlt ArcTo Arc AngleArc AbortDoc GetRandomRgn

version

VerQueryValueA VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA GetFileVersionInfoW

ole32

CreateStreamOnHGlobal ReleaseStgMedium OleIsCurrentClipboard OleFlushClipboard OleGetClipboard OleSetClipboard DoDragDrop RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize CreateDataAdviseHolder CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoLockObjectExternal CoUninitialize CoInitializeEx CoInitialize IsEqualGUID

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_GetImageInfo ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Copy ImageList_LoadImageW ImageList_GetIcon ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_SetOverlayImage ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

shell32

SHGetFileInfoW ShellExecuteExA ShellExecuteA ShellExecuteW Shell_NotifyIconW DragQueryPoint DragQueryFileA DragQueryFileW DragFinish DragAcceptFiles SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetMalloc

shfolder

SHGetFolderPathW

comdlg32

PrintDlgW ReplaceTextW FindTextW ChooseColorW GetSaveFileNameA GetSaveFileNameW GetOpenFileNameW

wsock32

WSACleanup WSAStartup WSAGetLastError gethostbyname socket setsockopt sendto send select recvfrom recv ioctlsocket inet_addr htons connect closesocket bind

msvcrt

isxdigit isspace ispunct isprint isgraph iscntrl isalpha isalnum strchr strncmp strcmp memset memmove memcpy memcmp

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

oleacc

LresultFromObject

winmm

timeGetTime timeEndPeriod timeBeginPeriod sndPlaySoundW

gdiplus

GdipSetStringFormatLineAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillEllipseI GdipFillPolygonI GdipDrawPolygonI GdipDrawLineI GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetPenWidth GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipGetPathGradientPointCount GdipSetPathGradientSurroundColorsWithCount GdipSetPathGradientCenterColor GdipCreatePathGradientI GdipCreateLineBrushI GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdiplusShutdown GdiplusStartup GdipFree GdipAlloc

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

473KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

133KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

81B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

505KB

Virtual Size

505KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

echo/EchoMirageHooks32.dll

IMPHASH d366e396ccbec601ae4b65ac499b8bff
SHA256 2c232c3e196cbb2651fd0c6187697cc4bae752c2b471875943a2dac9d8b02db0
MD5 e1390e79577ab2dd75e17250e73d4abe
SHA1 457b9a21f6b7a0e8297d6aa61c2cedb85adcd907
SHA512 4a4cdd4b66f7b39a56a5eec8a0c7e29340f4b032edd8da246feaf5dd2d4847d2586ffe64f172132d79b3f2a66ce1f861dc700e5eec83689de672eb103f2234e2
SSDEEP 12288:REMBdnYUv8Kc8FBymZTzD4byjH/0U9KR:fLYUv8KtibyfX9KR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

394644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor GetTokenInformation GetLengthSid FreeSid AllocateAndInitializeSid GetKernelObjectSecurity

user32

MessageBoxA CharNextW LoadStringW TranslateMessage PeekMessageW OpenInputDesktop MsgWaitForMultipleObjects MessageBoxA MessageBoxW LoadStringW GetUserObjectInformationA GetThreadDesktop GetSystemMetrics DispatchMessageW CloseDesktop CharUpperW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW lstrcpynW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue TlsFree TlsAlloc LocalFree LocalAlloc FreeLibrary lstrlenW lstrcmpA WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc UnmapViewOfFile Sleep SetThreadPriority SetLastError SetFilePointer SetEvent SetEndOfFile ResumeThread ResetEvent ReleaseMutex ReadFile OpenProcess OpenMutexA OpenFileMappingA OpenFileMappingW OpenEventA OpenEventW MapViewOfFile LocalFree LocalAlloc LoadLibraryExA LoadLibraryA LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr InitializeCriticalSection GetVersionExW GetVersion GetThreadLocale GetThreadContext GetStdHandle GetProcAddress GetModuleHandleA GetModuleHandleW GetModuleFileNameA GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCPInfoExW GetCPInfo GetACP InterlockedExchangeAdd FreeLibrary FormatMessageA FormatMessageW EnumSystemLocalesW EnumCalendarInfoW EnterCriticalSection DuplicateHandle DeleteCriticalSection CreateMutexA CreateMutexW CreateFileMappingA CreateFileMappingW CreateFileA CreateFileW CreateEventA CreateEventW CompareStringW CloseHandle Sleep

wsock32

getsockopt getsockname getpeername

Name

.text

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

340B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

echo/EchoMirageHooks64.dll

IMPHASH 26af301f7989ba106062d39730b88f65
SHA256 a1be1ee7ce08b0b02ad544bac5c871cd4dfeeb3ee2430a9ca6ae69717bbce507
MD5 b5373fa8a1012b0bb7098ba02f4494f6
SHA1 303fe7050d7bd59bd2522c97a1d6101a2ac4fe19
SHA512 7b216c01c544e600cd1904ee1555e8f76e1f99f7cd72396d960cb3d3be174bd717b7d79c2f0dc1d70223deebde18c839603c69e4dcd5b1170176253a73a73b8a
SSDEEP 6144:bk6Rm/QmvBp/Ilp8wovbjiuuRQRsCtdRkW1umr2Cbe3Fog6:pA4ij/If8RvCjPCtdRkWBG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

556880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor GetTokenInformation GetLengthSid FreeSid AllocateAndInitializeSid

user32

MessageBoxA CharNextW LoadStringW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW GetSystemMetrics DispatchMessageW CharUpperW

kernel32

Sleep VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW lstrcpynW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue TlsFree TlsAlloc LocalFree LocalAlloc FreeLibrary lstrlenW lstrcmpA WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjects VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc UnmapViewOfFile Sleep SetLastError SetFilePointer SetEvent SetEndOfFile ResumeThread ResetEvent ReleaseMutex ReadFile OpenProcess OpenFileMappingA OpenFileMappingW OpenEventA OpenEventW MapViewOfFile LocalFree LocalAlloc LoadLibraryExA LoadLibraryA LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr InitializeCriticalSection GetVersionExW GetVersion GetThreadLocale GetThreadContext GetStdHandle GetProcAddress GetModuleHandleA GetModuleHandleW GetModuleFileNameA GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentProcessId GetCurrentProcess GetCPInfoExW GetCPInfo GetACP FreeLibrary FormatMessageA FormatMessageW EnumSystemLocalesW EnumCalendarInfoW EnterCriticalSection DuplicateHandle DeleteCriticalSection CreateMutexA CreateMutexW CreateFileMappingA CreateFileMappingW CreateFileA CreateFileW CreateEventA CreateEventW CompareStringW CloseHandle Sleep

wsock32

getsockopt getsockname getpeername

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

Name

.text

Size

543KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

echo/EchoMirageUnelevated.exe

IMPHASH 7e3983ddd94510c54f769279fc03c4b1
SHA256 8b9cc2596c0434d223cc84627c770dcf9eb58180e18a2be2cede741a50e3158b
MD5 708c0ca4057bfa069fa456c43ef3ba07
SHA1 c50d48178837dffa7b0f00b28ac39139dbc98972
SHA512 e0648ff5b8b054ddf6efd3a39e00e9e47b5d98125102ec2f1421fa4b63d5089c2f984cadcbffd9a8d57d41f58561c2dee81e2993e9258c8490ec13644e53bcc3
SSDEEP 3072:tB8ppzENcUlunApdr2E+GLphDOaM9hYOflW2GvrgQcAn2aWofnvxeMed:8p4QAdrD1Hia8UP5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

161760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

user32

MessageBoxA CharNextW LoadStringW MessageBoxW LoadStringW GetSystemMetrics CharUpperW

kernel32

Sleep VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap lstrlenW lstrcpynW VirtualQuery GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess GetCurrentThreadId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary WriteFile WideCharToMultiByte WaitForSingleObject VirtualQuery SetEvent SetEnvironmentVariableW ResetEvent LocalFree IsValidLocale GetVersionExW GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetFileAttributesW GetEnvironmentVariableW GetDiskFreeSpaceW GetCPInfo FreeLibrary FormatMessageW FindFirstFileW FindClose EnumSystemLocalesW EnumCalendarInfoW CreateFileW CreateEventW CloseHandle

shell32

ShellExecuteW

Name

.text

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

416B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

echo/License.txt

SHA256 404e78e8e4aeb06f884f04fda9f397960c32a6567a8000b72fa9ae7d7c612f16
MD5 94c4233ca0e80bce01a884d8158bb8c3
SHA1 bf856002f1f8100b89449dbb4fa9647edf068706
SHA512 8f919db8b80bbc1cf65b3d3a0f3071b150537129a201f7d2510fdee4f4e8afc3c2d80db4b33b8acb20fdc2e8b6edee7a6ad22ececd4d121388ce21b056960a5a
SSDEEP 192:wuabbEdhWKU5at03sxBASUzf/1O/7MHRI9rDP0SqolN:WkPWv521ASSODnP0Sb
MD5 SHA1 SHA512 SSDEEP

echo/unins000.dat

SHA256 34f63b451b8ccbd383c9094b4a906dea82df0f719e146ffb7129f3352c3b1cfb
MD5 f6553352ef1e56650c97fa4642b68600
SHA1 1eff4a2ab2425bbee6f40c8a38e4be6ce2cd11be
SHA512 d9bcb8e0348e1d7d375a14804e641fed275e804189a1b37f305c8689142e643a47da446f9382636136ee52dfbac1b86c7f9e128304d52692816eab2e181cc28c
MD5 SHA1 SHA512

echo/unins000.exe

SHA256 39493b65a2ebc5a08c4ff8e5b5137114b927d7c99b69bb7d0f4f7a7603f99fff
MD5 16f9bd410649d056813ec6e512f27e0b
SHA1 ee003f3df76f564f82e2f455417af03f9e9f181f
SHA512 62507c25ddb1a77519eea51a2a24e5f5c1953b8b28125300e74ed2159c97ebc605f7d09843f017b4f0337f3bc32b61b996cbc739043a49d418b228cbe6719025
SSDEEP 24576:OPcYn5c/rPx37/zHBA6pFptZ1CEQqE0Rx9Ss:29urPx37/zHBA6pFkEN
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

625576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ollydbg/OllyDbg.exe

SHA256 14a0424c2940bda2d86169f5936345276b6f71409e6d656c0e721f43216fc563
MD5 ce17be28fab044e0ecc76cd721170803
SHA1 ecd04ffe9d64303d9d0a3f53814a09dce70bb843
SHA512 e78961acc4055294b0f9a82485d0ebe5e4d67858e5d95103f4a418c5d38388c4050d792fd58faa4d9859d273877edf7e6db90cb7de680a581c077ff8610e097d
SSDEEP 24576:af5qCRZramh/9zglpZImYQTx7WhdiY4GBs4ckpgOsJqwu:E4iDmYM7W+4FWOscw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

_Addsorteddata _Addtolist _Analysecode _Animate _Assemble _Attachtoactiveprocess _Broadcast _Browsefilename _Calculatecrc _Checkcondition _Compress _Createdumpwindow _Createlistwindow _Createpatchwindow _Createprofilewindow _Creatertracewindow _Createsorteddata _Createthreadwindow _Createwatchwindow _Createwinwindow _Decodeaddress _Decodeascii _Decodecharacter _Decodefullvarname _Decodeknownargument _Decodename _Decoderange _Decoderelativeoffset _Decodethreadname _Decodeunicode _Decompress _Defaultbar _Deletebreakpoints _Deletehardwarebreakbyaddr _Deletehardwarebreakpoint _Deletenamerange _Deletenonconfirmedsorteddata _Deleteruntrace _Deletesorteddata _Deletesorteddatarange _Deletewatch _Demanglename _Destroysorteddata _Disasm _Disassembleback _Disassembleforward _Discardquicknames _Dumpbackup _Error _Expression _Findallcommands _Findalldllcalls _Findallsequences _Finddecode _Findfileoffset _Findfixup _Findhittrace _Findimportbyname _Findlabel _Findlabelbyname _Findmemory _Findmodule _Findname _Findnextname _Findnextproc _Findnextruntraceip _Findprevproc _Findprevruntraceip _Findprocbegin _Findprocend _Findreferences _Findsorteddata _Findsorteddataindex _Findsorteddatarange _Findstrings _Findsymbolicname _Findthread _Findunknownfunction _Flash _Followcall _Get3dnow _Get3dnowxy _Getaddressfromline _Getasmfindmodel _Getasmfindmodelxy _Getbprelname _Getbreakpointtype _Getbreakpointtypecount _Getcputhreadid _Getdisassemblerrange _Getfloat _Getfloat10 _Getfloat10xy _Getfloatxy _Gethexstring _Gethexstringxy _Getline _Getlinefromaddress _Getlinexy _Getlong _Getlongxy _Getmmx _Getmmxxy _Getnextbreakpoint _Getoriginaldatasize _Getproclimits _Getregxy _Getresourcestring _Getruntraceprofile _Getruntraceregisters _Getsortedbyselection _Getsourcefilelimits _Getstatus _Gettableselectionxy _Gettext _Gettextxy _Getwatch _Go _Guardmemory _Hardbreakpoints _Havecopyofmemory _Infoline _Injectcode _Insertname _Insertwatch _Isfilling _Isprefix _Isretaddr _Issuspicious _IstextA _IstextW _Listmemory _Manualbreakpoint _Mergequicknames _Message _Modifyhittrace _Newtablewindow _OpenEXEfile _Painttable _Plugingetvalue _Pluginreadintfromini _Pluginreadstringfromini _Pluginsaverecord _Pluginwriteinttoini _Pluginwritestringtoini _Print3dnow _Printfloat10 _Printfloat4 _Printfloat8 _Printsse _Progress _Quickinsertname _Quicktablewindow _Readcommand _Readmemory _Redrawdisassembler _Registerotclass _Registerpluginclass _Restoreallthreads _Runsinglethread _Runtracesize _Scrollruntracewindow _Selectandscroll _Sendshortcut _Setbreakpoint _Setbreakpointext _Setcpu _Setdisasm _Setdumptype _Sethardwarebreakpoint _Setmembreakpoint _Settracecondition _Settracecount _Settracepauseoncommands _Showsourcefromaddress _Sortsorteddata _Startruntrace _Stringtotext _Suspendprocess _Tablefunction _Tempbreakpoint _Unregisterpluginclass _Updatelist _Walkreference _Walkreferenceex _Writememory __GetExceptDLLinfo ___CPPdebugHook

Name

.text

Size

698KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

116KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

ollydbg/OllyDbg.hlp

SHA256 61cec3d3cf79dbcd86b076a3ee6f252213dce9c7ca400e6a7eda4e292d35d16c
MD5 909ceb8d61be31caa8099a7fb47e2eb9
SHA1 390fa7e339861836916475361b5bf3d8b46b76c6
SHA512 2f9b54d4c8a30677fc803df4dad51f219f41409a4d3c9b7a01bcf8c5bd9d57eccb53d43073e9e9bdc3bb00cceebb20f8cdc204659f9db46dcf8b6240d0f870e7
SSDEEP 3072:9PXAUi7DwFDwjDwoZ+JT9MKaPn0IrgdwxKDWNPhO4ZFDwjDwYWY1aZ+BNrRm00qV:9PliGWt3qG0VizuNQyModzfP0C6Il
MD5 SHA1 SHA512 SSDEEP

ollydbg/OllyPath.dll

IMPHASH cf629ac1f9b4db24ba83bced5269379f
SHA256 5d1e1bd2f1278d3527f1bf23c7a915767d72be69284709cd373134fb0ef88f2f
MD5 0babc537f3a189141ca724e84703d35d
SHA1 a2159420f5222f4cecc2b86cdda0cf500cc56ae9
SHA512 a4e90624aa897e9b07bf05bbc043530cb5c4dc07345cdc83e871b381a499b6b18152543a9a4bef8733261b36e200052e3ab3381e604c8a8c05348861eaa41c45
SSDEEP 96:ERlG5duhD4Gar3o77qoCd8Wh0Bt3eb4uCsShF+y73Sa3FHSr5QvOd:wGG8H477tCd8I0Bt3e1EF+q1HSr5iO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ollydbg/Patches/OllyPath_mod.rar

SHA256 7eb50ca8ec3ab766bfbf51d625b61f8b9ef50eff55cb07798c092402be33554c
MD5 61e32a5747f5350c0b656b14179c150a
SHA1 b3b13beb823c33882f417df73b19f69c522be53b
SHA512 8ab8ebce607d4e4008e6e499694ad3270f72f3d61bc03c95646f1293130505f141ae03e85fba7c27c6354c33e002e078a56f399625248bf414ef1eb49539716d
SSDEEP 96:E3YNVCEQXem4J83goCHefgenqdhwttSHBvkHj46yPAbPzT0fMbbxwxRPEC:sYEXq83goC+IenqdgABvkU6yPaPzTFb+
MD5 SHA1 SHA512 SSDEEP

OllyPath.cbp

SHA256 d034305252a4715f0c671f9a827810f7955eb8c1f15212ceeb74af93dc801cc9
MD5 5964b0f635df89a1ab0e7e7cda5952b1
SHA1 ecc2b8d1a8bf4323382eaa6cf64cb621318b44d6
SHA512 f2fa117120f66871da9951883d181a8ed4fec0faebac97747ce26dbcdedba60e770f40c08bdc3d50034f1290e36aaf5b94b44d3dc7b2baeb4fb75a0874aad5fd
MD5 SHA1 SHA512

bin/OllyPath.dll

IMPHASH cf629ac1f9b4db24ba83bced5269379f
SHA256 5d1e1bd2f1278d3527f1bf23c7a915767d72be69284709cd373134fb0ef88f2f
MD5 0babc537f3a189141ca724e84703d35d
SHA1 a2159420f5222f4cecc2b86cdda0cf500cc56ae9
SHA512 a4e90624aa897e9b07bf05bbc043530cb5c4dc07345cdc83e871b381a499b6b18152543a9a4bef8733261b36e200052e3ab3381e604c8a8c05348861eaa41c45
SSDEEP 96:ERlG5duhD4Gar3o77qoCd8Wh0Bt3eb4uCsShF+y73Sa3FHSr5QvOd:wGG8H477tCd8I0Bt3e1EF+q1HSr5iO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

main.cpp

SHA256 27021e2f363ee8930cb86289bbc959e2ff44cd057e9ddaa48c2a511c124e4695
MD5 17cab0f12f9eecf43d5cd14640f60f7e
SHA1 e3f558bff9848505021909a5674bdaee68fcb2fd
SHA512 7b5791e42ee8325322de10c74f78e5ccb08aa17c855b65b0a265475a0db871a107b3d102a83519cba4aab0c5191e0ee15abd4787d60b4b88d2cb209e979da758
MD5 SHA1 SHA512

main.h

SHA256 46be0f454bee35a252db431742ade86bc62ff11e11bf0fc5639401b6a4a0e6e1
MD5 7a6ecf1ca8912ce986817dd60e2fba95
SHA1 92634aebd1321d795867fe120add4db576af7039
SHA512 d33aef64c2652075836dd30b43ceb2764685e0d0af8524999b43d00d9f0509dd7db2b10a6da3b5e35e965d813d9a1540cd6188fdbcb34d4dbe95ccc2fa4d8c3e
MD5 SHA1 SHA512

ollydbg/Patches/patches.txt

SHA256 321c6ba8ed05e0fd09743eb38ebb82f699b164417c3308fed853edb511692c72
MD5 e0347f9a1ebc535a3c2753cd424b9163
SHA1 647143117a83f1caf938567c47a344b163dfd663
SHA512 755d2a6c59c9a817cba1c93ff3d9e7c7b122eda106e31d7c084938cf950e41d7dba25a60bf6305b2665e22efdda6f99d57464eb6204ba394e00cea75112ba944
MD5 SHA1 SHA512

ollydbg/Patches/plugin_patches.txt

SHA256 e04b712d2fd122400995963680e22060aedd9fef9613312c22fb64ed1e324008
MD5 57f91a41104ff1988f0c271e56b7e5c0
SHA1 b59fa241cc7795676d04d5319113a7679345a564
SHA512 dc881c02eb8efdeb41415088273b34c479747fbe9dbb12c9dc546a6d6d538840925b915a6cadf093ea014bc86789a9ec73dac03bba6a3b81cdc8660bee2da133
MD5 SHA1 SHA512

ollydbg/Patches/replace_icons.rar

SHA256 8b79f484b806fcdd6099de230b49e4b22b71570177ff5fbfcf607288dfc38736
MD5 e2c3a762eabfeac35100e3444a9be95f
SHA1 4c5a008da5b931f929df067b0c9fa65cac8e004a
SHA512 374afdb6a08cd152edd542e4e08b2aee83fad3c6d6e7c2012f5df0af625a50d2fb0dd3a59cab326880f61b49c4b8c7ebfb3b073f3180df5926e95db2ec5e7f2d
SSDEEP 768:W78+RMQ740pvsssdtOEb3ytq92xDP4zQj70XzOqJEyTKRBwFmGH9cEEn:5+RM+4FHtRbp92FwzQvBq//FdH9cHn
MD5 SHA1 SHA512 SSDEEP

BITMAP/APPEAR.bmp

SHA256 e1e595afcafa52e4e508bf09bbda9f41fd28fff6dfe76c4a4df1bb15388ac0cf
MD5 36c3153dc49846c33e67f56ccad1236b
SHA1 afded5ae1816eed876a6fd129ed96416d7e1f83f
SHA512 1fcb31a2202b86a1d2abc884fbd08b3f461316b1edaf9a99e9b22b8353ea2b694f0c929104f470ad6a482dd85c4a3a872f311ee55c912f456d791a709da1618d
MD5 SHA1 SHA512

BITMAP/BREAKS.bmp

SHA256 3ea3e86ee18e9997deadb14f37f9e00d5a3f0f26b838f1593ec9a8daa30db54b
MD5 4035b866bc5dadd8b79104d530ce20c6
SHA1 2947f436bce55f2669fa0fb00adadd9317a2d55d
SHA512 3a81c2a0ea1d793f9c86f9d6fbc0e86c74dfd3b11e657d0855ddadd8cd82fa6260250501e486c7c06e996a8e1d12375efd7dd273b1dfb1292296347a8bfd3def
MD5 SHA1 SHA512

BITMAP/CLOSE.bmp

SHA256 b60ae562d7a0f4c1d87fd7509b3dc2abb9339703d146e7e88b2fbabec6fc1173
MD5 5b0bad51692cfaa5a822b14e7894d3fa
SHA1 fbdb27ee666df49471f5455eddb1efebc5c6da4a
SHA512 0c03d8e1bbd9a6120df2996815e39535e83da20c34cc00d9351b4bbb5fd43486279f1178d30a8086dd7c35e0ae7966997aa5025304defd07bb415434d5b3bf03
MD5 SHA1 SHA512

BITMAP/CPU.bmp

SHA256 26f89a59f0c78c48e4d24e8497264f1a6299070410bfcc3353bf8a464b1a6d9e
MD5 16037f84b83576c6384354a56158ced1
SHA1 dcad4329ff65012945db27815a8e6d719d1a9061
SHA512 4dc42234a18cfb5b1b6f038a2298e00e711df59064a8f7f60d0572bc87acc7e8020e8af8f9e789929a0b6160de55f892664aa7762ed9a92f32409cd95346b07a
MD5 SHA1 SHA512

BITMAP/GOTO.bmp

SHA256 aa5b293ce6f0aeaab1b243853a2943e00634758db7a3a4971b6f6dd0773c4f33
MD5 74c199bb2996887e646a4e754b9e227b
SHA1 8aac06a0617e3fd34bc678236481f0a4dba68d5a
SHA512 9c47b3ce7d2b0b8cec1d2f94945c4ebc2e95ec673cabb830ef779e8c9386c0cd48dcb40423fb1ec32e730632ec0faae2a144df29dbd3f9f642c40498c271fc3a
MD5 SHA1 SHA512

BITMAP/HANDLES.bmp

SHA256 d353173b731eac03e410126f747d99cbc6218bfa6d0ceed54e8d6532adc7bf6b
MD5 d1399c647d46eff4fb9b3f5f4ba4e1d5
SHA1 afc200b3e449ff9a05c5114202530bf3a671cd89
SHA512 060038b9b694fbc2bd814db38f86c6310036bf7f8e103dde08d2c0ccfc7012ec5aaba1f1e3006582d5dc50c851088a20b79b4f17157ac1eadcd26378dbf0b8c4
MD5 SHA1 SHA512

BITMAP/HELP.bmp

SHA256 4846f194e3727b0673de206f86e5250d28e7955d5e7d4e37f9ae5020b2fb1d7b
MD5 3a4b6b38fea4bd2f59ebc0681ac3efce
SHA1 cc8673626ec412b071b2fef13a4388416aa9440f
SHA512 be9aee02e0f8916488378f604507fc0c8dd257caa46451b41c54a2c613e9d044a5ed4e9d56e21fce20daf5dac8694150372a2284afd2ce86a0916794e484f2c2
MD5 SHA1 SHA512

BITMAP/LOG.bmp

SHA256 4e2e7ceeafa3460cd22f896d244fe4a7b363dd77d5c09035d308a9b6742a8176
MD5 cd9cb8c9155bc8da49be9ce28a2c2466
SHA1 6b638bd702f542d4464d3baf08751165a81fdcaa
SHA512 d0f6a4e12355492092e0f3bc5f7b3ef05a595099dc00c538de41c1839cfdee6a956b8a5552b5733a92879c6aded98a866c21a0616df1ef9d1c0ef2fb62c0a7a9
MD5 SHA1 SHA512

BITMAP/MEMORY.bmp

SHA256 658c8c3a8135bfc76962da602bbc24c7d8290fec48e44b9aee2ce78e0b866fa5
MD5 efc5f4c36eeb8c325408c455d612019d
SHA1 b2c9abee8074d6f18bcedb65984835610d37cfda
SHA512 e0f77eb76fee10d5b6c48f3625cfb5f100db973fcbd5148996b56b1283eeccf5d33b105b96c13d59375c2928e2ba588c5022bbafe7cb8ea2e58bfb19ca0aba12
MD5 SHA1 SHA512

BITMAP/MODULES.bmp

SHA256 400f7c44669fdbcd429a218d0822ec2201623374a72b36081c9563e2ff7f0f19
MD5 ad6cf6090003b4cd5cebf6c78b0221d0
SHA1 b068ef6725d54ee6cfcaaed6402f2f992841b3aa
SHA512 2a42ca4e588358c3766edd6c200184d14ccf0734102d600c09afd09e59a5698e913b7fb40284f5d63070a70acb1dd141acca414927bc92ff8a04e4e4e62698d6
MD5 SHA1 SHA512

BITMAP/OPEN.bmp

SHA256 b30f139b711f9062472fe23b794e1b62c36e2025142e3218b29f240aa172833e
MD5 87abb7ce856054369e2561a85547bdf9
SHA1 b49b9d5c4ca6815ac4e34e8c6b6491fc941c0fbe
SHA512 7c9a249eedc150a218ac20f531c463edccfc11f8eaccbc8ccc0839b0accf8c14c8e04a8241d76102512d084951b5d80c8952698c36dfff5f5a2a514507be5873
MD5 SHA1 SHA512

BITMAP/OPTIONS.bmp

SHA256 c460ab1caa270853a0f4004d6d56f8f035a431a23a438a7ff37c0f83de74a940
MD5 a8b065921565bb7f4975cc6f2105db54
SHA1 21a2b509d1d7cf1ea75edde5b28ad144d7c537c2
SHA512 48890037fc918e03e30db919d842364c0d97d6be457e8913c4c3786c1f89d9b2add27b49f15e091dacf6784c7d0bd9efb3e13a078ea29d33e75ae586dd1fd054
MD5 SHA1 SHA512

BITMAP/PATCHES.bmp

SHA256 a44ee95814cbed5d20375d510e1eb1d7f3934887d485288ae613ab45a914a61b
MD5 1139e375d5a4a4df85c096c9b65953bb
SHA1 af2f7cdd567c5ca21437fe04698e3e773607cd25
SHA512 7a9055041c9e8e2898ad63c715bf1625382f1371bd6a0d91542960f5623454def1e06bcc5ac18fea0271f1e702269242c6beda1f9234fd34831abaf4fa6687ab
MD5 SHA1 SHA512

BITMAP/PAUSE.bmp

SHA256 770b8833a68db7c1b05e76b99b38638b117a720290250ce00847619e14f25efe
MD5 ff86aad4074c0148b60c29242ddd1b04
SHA1 78a9e4db77bfe405aa60f13ed61f4ac562cb6e71
SHA512 c6bcb5a0979bcff8b4c71cf8080b0cd0606f48559b6033bb6577284aa486176151c79db86465d6f02fd0495617f25d7fa907d501a8f8b942374938bf15dd76d9
MD5 SHA1 SHA512

BITMAP/REFERS.bmp

SHA256 280ac0678263e50d0a13823063608e0ea7760b7f410b085ec4c3a988d73188db
MD5 529d91200931ae4fde404be93bc0015b
SHA1 35117881b9bb4cfbccab0930b3811907adb91f64
SHA512 8e31fa65383351d4a052518ca8abe09a1d9aa4afe183922b4e9540ce4fbf5d3ed461da15f7ece2e7132175fbf7bd67bacf6a2b942cb20c15e21bcc6c4de0e7c5
MD5 SHA1 SHA512

BITMAP/RESTART.bmp

SHA256 e917e31ceb334504d4f13942e20a94e8508cde43f801f1d7d4450976304759df
MD5 eb1f4955246b188b7bc476faae2bc0b9
SHA1 13cd9955e664e7c0cf837590c484e76e9c552ef7
SHA512 6da3c457066fa14f39facb05cd073a9ff2234fb9675b5a4f26738c39948ab27f3767bb519020d39770ca92b4dae998e072121709c241d62ca37bf616ada47cfa
MD5 SHA1 SHA512

BITMAP/RUN.bmp

SHA256 b74daf364539951244b27e6537d563c9875ef105089b3ab189670489bd29774c
MD5 1f82cd1f39d7ac50ecef9f5e0383feb5
SHA1 dad02db95cc25aca01e2cccdade551cf3ffa5754
SHA512 1d19509544ad1e2c96d2f5b316db3d83922a14a724ea735260ed2edb57332f8cb4794af16a71b114f341aed588a6dc2e94e5a36d46e8a4e323632b9f5fc1eca2
MD5 SHA1 SHA512

BITMAP/SOURCE.bmp

SHA256 c042a645e73a2ba785027a5d35b1ef57fdbc3198f94486d570b76d408c404c0e
MD5 fb27c8183c7cb3d8f2d12226373e0c91
SHA1 beaa60e32ebea20b3885a4dd8e98e0ad2d43c1b5
SHA512 68fd5e0e1a3f4707a13427ec46338e7e9fde7d222dfd451e079825423a0a0d8c657bcd7a62a2e6d79d017b78277d768fff7770a6a77fc453b29c42423f4cb8c2
MD5 SHA1 SHA512

BITMAP/STACK.bmp

SHA256 b9ac223fc4a3942823f3cd6ae7afa991a516ae2185b904f76097771ee2ea7cfb
MD5 168fcdf8279c99035af609a58dba6ffa
SHA1 b7b2ddb0d0e8c0de135a8481cad1954c76f06dd1
SHA512 c1766d15a975d02ebece87bc4cf28cff7ed22ef130a15a1b9c636a395afd7a8c27bc92594b67ca5fafcfcac6686f596cd67eedcb089f9ac513a6bddf91b54cce
MD5 SHA1 SHA512

BITMAP/STEPIN.bmp

SHA256 4fcf94e97ed4d841d0abb702b2496210320fbf754e597bc22d7cf06fd9e064ff
MD5 9e911d80019a270d1d961d64ae578096
SHA1 cb02140aea0f1693ae73d24b181c98aa5a57b220
SHA512 0f2e5304acc8a9954c64848a314ed72b5a199bfe85cec56d408e37e393c8a5b7acc03dbbb40a600d1e845785ad1d0b985f26a8535e71849058409f48a8afc1b0
MD5 SHA1 SHA512

BITMAP/STEPOVER.bmp

SHA256 6d632823f9d580df2142999ddf43abb32b5f9e3e2e2fbe222af19b89ccd8d90e
MD5 5d6ceff7eea62fbd0b3246cc49665150
SHA1 497652dac0cf2e7044b01e21fd806336558bbb08
SHA512 8534ea127e8e87bf039708ad88463b0a7a78841d24bfdc2193b20da900e345b2ad646dcbebab775e662b38a13540e81ffef16e39c88c3558c3415f372bd706b6
MD5 SHA1 SHA512

BITMAP/THREADS.bmp

SHA256 c4f3a83eb385bac476ca796ae6ddba058bb441303938d4b0ff33bbc8d4559b1f
MD5 c6561eb0758952c717a4e0541a358dd0
SHA1 50f7e2ae2ff8b96c7df476e5351745e547f1ca96
SHA512 4ccc39a7196205655afc81731c1e378387b08039c59010f721ad57cde39eb89f766871e322824ed6fa49571e1d17e246ad24f436f5f06af088637c65e17bb564
MD5 SHA1 SHA512

BITMAP/TILLRET.bmp

SHA256 4184ff19afecb1a4fff316801320008d76df5869b544e549eca4c8bde46a85f5
MD5 fe4d9fc6d998a414ba90afc27df76660
SHA1 45e725848086f4bc1ccc69cc862647f9b17e0b1e
SHA512 7ba17cba5aa532d0974853cf908b4978f9a11266549afed3f3ae584ef81b83e8e9f41a6507dda0acb0efe9079d409ff2fc27456d8e30794f1bcbbbe771735a74
MD5 SHA1 SHA512

BITMAP/TRACE.bmp

SHA256 bb9d87305335ca481e8a759936ec0f5815a9c65a60c19da176955fbca9411b66
MD5 fca6882d707d204863ed37974bf79e9e
SHA1 48e748458611190865aa414f7265fa3bf8b53590
SHA512 59f971f47da571b29bca435f54d12d411d753b15bae8b37e5076dcfa725ed9d02f1980f9a9fa8cae7ee5d19eb57a7d0926fa36fea815da7f753b7461667c691e
MD5 SHA1 SHA512

BITMAP/TRIN.bmp

SHA256 e6716915802b3e89854fa113e33ea09ff21c24941d348c1f2351860804676b3b
MD5 9ef519f086d2693d52e1f4ee4c274f9b
SHA1 786bc9d29aebbc938724d7261176bb69e726219e
SHA512 09bb522f741c354ce1f323a8661bfcd5929121fea4a2a4774e905c1261628617093c919d0dbfbc6e6912fa52f9e084dd3ac336e8f3189ab40b7c955aa876ca57
MD5 SHA1 SHA512

BITMAP/TROVER.bmp

SHA256 4ff138ac438bb4d478e950ccb54c1db480d7abc749e044a58267e93c8abe4cc8
MD5 21dd8d69c8186f9fe34864d139ba7e2a
SHA1 5c3f04078e324d84b4d56f24b8f7729c49bfe27c
SHA512 f91b5a679e5b7aff1a9f84137fe46730071e715057081acaaeb4e79ef6487f3e82014a4492167d200194d0be7577970f611436abedb428509ebf46bdeafabbbd
MD5 SHA1 SHA512

BITMAP/WINDOWS.bmp

SHA256 ff4a20c0f7c5b2bd8686191e876548df6e0701b8789232bfb6edddb547451347
MD5 12c7733050577989d1f0463dcbe112ae
SHA1 fc69c590646f2da5cdb69bd7a2d8494402576703
SHA512 dc024da15e305decc1f2bf308abea5485f1dd7db5a1e8759f5055ec5a91dc6670bba4de013691545c53429d59a45b5dc25372220458804c784074ff9b11c58f9
MD5 SHA1 SHA512

ICON_ENTRY/10.ico

SHA256 7a345b81961361a5c5b42e3beaa80d43ae9da02f94875e78abbf15a1110f7bec
MD5 e562baba1388946f3e9b3a0e5aef454f
SHA1 266f8a1381add7862cbef2bdd6ef2f8ad096001d
SHA512 e0cd99c2bf53f27589b58a5d3469746c9b71cfa4aad84812f6cadfb24b53ebd0dc1960df717d8ad47f7097c5349626f55e5215815f6aacd0ae8a46bb094cfd09
MD5 SHA1 SHA512

ICON_ENTRY/11.ico

SHA256 9b8e7f32fca4af36cf84d0c04d00002cc57f633b1b717288d36dcc92d4ea6592
MD5 06f8792d7d9b3db321a42926e168cf24
SHA1 65f830ca720ad25daded9ec77df931449139e735
SHA512 e4ef284fc409c215362e7939d8f2e257f332dca19bc1823f3986ef1101124f7e0e1aaee5d419cc7b74cc7ef72946be947b649578a21955e48531509eb3c25a0a
MD5 SHA1 SHA512

ICON_ENTRY/12.ico

SHA256 f95f91b0c9104d36c213c8697961916ccb1f30f568f3f1be963cf13a90be316f
MD5 88683c930e58be167cb8b779297d42fb
SHA1 e5a6fd7c4c55a0ac93ab713d58d7ab241d16ab02
SHA512 6672cfb2e7a8552c53aeaf451915229f2200c26fa73fd8b66a7116a66a79c0eee200bb17e80f483fb7c30c4557d27301cad15b1fc490a1b73de37b6493a85a78
MD5 SHA1 SHA512

ICON_ENTRY/13.ico

SHA256 2b1e2a01e62ff363aac9501ceb8d6762c0771e15d94e4769113d11bd799aa62c
MD5 8c21adb0a49928a1e718d4b1f6d7beb8
SHA1 2c80464982d309175ae51915cb1353c56334674b
SHA512 3209f007af1e2232bc780341c40a1f5c5badee8ba3bdd8203df1206f16ba5779179a36f2b78f30b0aa60bd7ea3d5d3f3fc931bd6f53c2e6a839a7994a3840ecb
MD5 SHA1 SHA512

ICON_ENTRY/14.ico

SHA256 4be4a9e28ee920174f001611ab834a5d6abfd45c8365631f19b5c81490e03490
MD5 aeb9d163d5c586a0efbb331f8bf4b4dc
SHA1 a542157a89d857e2217992274c2fa092895b23da
SHA512 2dd18e55d46e934909d80073d01069fabe8565b59f7919abc026c9f6ae056d0b55fd7cd430040fc1e4a19d7e1191af7b2f62372a77e0bf49938bb02837d82e8d
MD5 SHA1 SHA512

ICON_ENTRY/15.ico

SHA256 75811e7f1ed00186927db94ea1c5cc3f787d3a912f0c4fb6ecd7920475a0dce0
MD5 aaa79efdd49217d9b45667878c7703ca
SHA1 898133f3b9bb9b48c0c30a97a89db56c198faa5f
SHA512 e8475edc81c56322da8653f8adfbb18592e9d0adcf754a81af1e51f6846e0a68d02ec71f0b8774dd2711406720644639f178887c856230aedf4f57795e701533
MD5 SHA1 SHA512

ICON_ENTRY/16.ico

SHA256 83ce3dd480861524b71961b49962e73ef9dd2dc05afd5be15eb060ea26defccc
MD5 2125e442fbb93d2417dfee03cfa4ee1c
SHA1 30224307cee94e0bda5a4b47c1ad729014aaa5ce
SHA512 1c8bc565b29af326bcdf90c5fa8341ec0d83962ed3b1c447e441189281d579ceef57a03d6f94007e325682198fc77ddc5a0d6eac4aa460421c0a27782f5f6549
MD5 SHA1 SHA512

ICON_ENTRY/17.ico

SHA256 c3d7d82419b880cae3d123e407d38f2fc8a34b1604184c67ddd6d7ae13adddfc
MD5 3fc26c42caec31b0348263644a00619c
SHA1 4f6e5072b62cf06c9f71e6e59cba67a01f6bd285
SHA512 9e621f5c7f6e837fc67ae052c17b91ab7580a6474a9ccddff596d7881fa0db54badbe84b5b56fb5ac0550d6341f4d168fb97918c934969ac43aad2ddb6fb7cda
MD5 SHA1 SHA512

ICON_ENTRY/18.ico

SHA256 5ec0f8b65950b0607ff96773a6292a29657a93ce5e85faa862605e0f2eca8a12
MD5 2fd6940dd1c6109e751e50a424249c8f
SHA1 2698b2b60ed20b92c1e2438704250d697ae43776
SHA512 84ff0b5542968c3747864c852a546d84b71d51beb059108df45c37c440bade0c01e9102259c2fd411f7511d4c7639237d70bf367228a877459c1d9d2b7454db4
MD5 SHA1 SHA512

ICON_ENTRY/19.ico

SHA256 dca2d41a3480f3f3fc5346a878a983eda000b64b6244b59820f94638e20413d0
MD5 4f955a4e2560d0a60c12b0344a5dafb9
SHA1 938db4ecaba549db07a0daad5d51f2b89e39bd05
SHA512 a874e369424e632b831cc07c2472efc0a5fff75683de9af27122f9d61f69bebc60aeb7700027012b18f5f6fe2db870ae6514fcd56749730ce14dcd100593c3f4
MD5 SHA1 SHA512

ICON_ENTRY/20.ico

SHA256 b0d6783fc9a58dbe68daf0e2a93e206bb4e70ad3addba52d43565b00455cd63a
MD5 4f69e27d39b6cd43759e1796347bb9e4
SHA1 902af3cc4ddf97fb5d0f6225683312cfd96d8bb6
SHA512 20fa5a28cb9c38c35768430e154078fcb96d78638c9712a1e2737858dc5e9b10f370a828bda841ba5b5b833ad94ad4e69b936a7f9e496f796cc574b4ccbca11c
MD5 SHA1 SHA512

ICON_ENTRY/21.ico

SHA256 11bed1992a964f358e2a55d4660722b449f44e6f793a4d8579860551a23c100a
MD5 f3c2fddc73a4644b683c560cfe1f87d1
SHA1 5687850162aa5d1d717df0d2c1399c8b7ddb3022
SHA512 6f0e80d5d4e9e52b3a2ccac7879490e72deebb08ee03fde7ea45b8aae6c54bfe5d1951cd55f40725d56003f8fa64baba6577ff5c6deda8b0132b8c8c5fa85029
MD5 SHA1 SHA512

ICON_ENTRY/22.ico

SHA256 4d61a4a7b7984198f9648a814ad205d7021f674a35d21177a97cc22af1d93334
MD5 5eb3fd035476ca3083b0992d22376cf0
SHA1 615be4a250c40267a17300aea2b62071a86d1b79
SHA512 db5e1607035803bcb27a896f29d2d5ff9a0d4be7786b30e849ed88ae14afb00eb3f015c50c4b9d56d910585cfbca231f7a08c03d5d60c5fb7246acc3b4b254ca
MD5 SHA1 SHA512

ICON_ENTRY/23.ico

SHA256 b41310efc71eadd6145cded92b3a0c47105d24a6aa1104f69f52b0fbceb743de
MD5 3deb054e9ba1e5f7798eb394b65ee701
SHA1 ee1f40cbb7de2a61b4ae24f60c846674c2370750
SHA512 4428b6554562673a65d78dc095318e2d57a8375b700d92eb80adf03407891a1c8eae778e8cda3dcb8347d7acf70ee0b62671e98581a4919362856f5090af4d84
MD5 SHA1 SHA512

ICON_ENTRY/24.ico

SHA256 d96b209dd08de0d981a3d1ac558722bb01a741f8a475b8c723337ef39d935c62
MD5 8e0f8db604709b0fdba5b8ed268afa5d
SHA1 2fb9e178db487a9abd2fd08a146a5783406dd5a1
SHA512 1c7845e0bce484694228a5b6ccd4eed61653a52b984f4e80b6f6ee61f2ab7c16296f9448266b5c4eb1e43c1fe0382fdf38ab4a19c8779d9cc5ad915ac1363d94
MD5 SHA1 SHA512

ICON_ENTRY/3.ico

SHA256 2524422c04ac0220bb03d579a748e4d6b16c63f7d9a83cb5db3cd7c25b0adba4
MD5 869ee7b02743d3fad79610e5f3a41875
SHA1 8a995edb5cb2d225cbdf9c95eea33d21502508e3
SHA512 d6c8a8cd44bafaaefea20efa32bc441004cf58d771203f41035138d90ccf792989ff666e2441432cde3ac86e7c52effa6d48046bd6c188d316bf7edf4e15c309
MD5 SHA1 SHA512

ICON_ENTRY/4.ico

SHA256 30fbd37004efa01ded6726941f44b8920b2af385ab9d3b3ac2be790a47d2f8c9
MD5 f0fd78b649a239b16a4623cde5a1c7d7
SHA1 69cdd4749b922ee9ce89e7d7e7aa497313f0aad9
SHA512 bc4007e3cbad991f50cbc1dc2b4da57b1c9f738725434773d50a9f78a7a01a100bfbe5f3ea893e1db826893a665faa927eb6ce33b6ed1104fa7e593eae574ec3
MD5 SHA1 SHA512

ICON_ENTRY/5.ico

SHA256 9c77e7c51127466ab2e5a6e16ab1c34361f1a620c4d477ab52c7d41675023d30
MD5 71ee2008d78bd241dee11911a1ffb817
SHA1 1390409103afedd758b0a90444c6ad91ec03e930
SHA512 01837256bc44d7d369267e00c799fbbe4f33c4447355b486d2201c49b1c94a15b2dafda75aad528caffd2d6339f37b627b5bfda6086b928df128b4d409251bdf
MD5 SHA1 SHA512

ICON_ENTRY/6.ico

SHA256 f0c4fb9d9147c1d06c5c0433dc0c5f913653c2ff3c755c447ffab22b77fefec1
MD5 9a1960de6d190a0ef64e60ecb0f7ccd0
SHA1 0f297a4fd11882a0ec78d02d67752714d3f2e35b
SHA512 745bb5f0ae901987c06df59448593b1a142353ab6b956b030b8ffa9fcbabfdf8dee47e6be40704d69efcce7b89474df667b763e2306d7112be99b0a078cf53d4
MD5 SHA1 SHA512

ICON_ENTRY/7.ico

SHA256 ef0433851d079863ec9f698cd2f91d545a7ba3f162de1593fb65fb9b5f5396d0
MD5 a7c848bb96ae397fcf8ac9e95bf30d2d
SHA1 8e86d1536115fc1e3628c8acb9a6eb7b4aefb0c6
SHA512 a24f919a897d032f39b7f34531e7e0fcd880bb3d8ff69a94b59886d943cc69fc4f6a0512e24d80dfd786b1d595a37918b105dd591a65af037e90bcefe3950348
MD5 SHA1 SHA512

ICON_ENTRY/8.ico

SHA256 94fe8e139d3d12d32063f87a2914e30fc9012a3ba0066b19afbe48479989be95
MD5 be5661687c2d1018c7908fc7b147c107
SHA1 2567790721545919f6eb9e6df617b7c31ba35b81
SHA512 5fb6e51a0f367fbd89aa5e216fd5d5bb65838548a5a3c65768ce0320aef43ced1add14738d41d9a0425bb332a055f439343ac7027383a7b6d5afbb6b8f831bf2
MD5 SHA1 SHA512

ICON_ENTRY/9.ico

SHA256 8874ae99eb7ab2cf1263f06baa8184f36feea03f7f4bd41b9293a612ddf440fa
MD5 b342038557eb96e35c0cb30aa2e872f4
SHA1 10efd37c46d653a9b9fdac628394e7d067610fed
SHA512 6445fab27941fd5bd30baa853e405d093467987c4c953a2b528a6ad8b0e1517e529a41f6b76ce725f23c37bca7527b56aa72fffe9425f1767cbf57ea30dc96f6
MD5 SHA1 SHA512

ollydbg/Plugins/Asm2Clipboard.dll

IMPHASH e61f2f894125bb9afbf614ac34b38d66
SHA256 9628e88144a89d4bb9093946fcf708224c151a2a2624ebc2ea69af0d4bb547d0
MD5 5a9bcce60dce9ce4754a4d76ea37e3ac
SHA1 2f547e31c2dff4d8eaa79d07b2855724eec026a2
SHA512 d37e12b563813ccb31c7709fa18adce63347046279b1fef7994421f2306093d3e5feda90acc5d5fa8d1eb7dba5957b8477a3852bccd501baa61021ddfa6c3053
SSDEEP 384:eyu142rxaHTl/SZaeRZqTAbLBdwQPXfvp8YtDxKmlN/SUlyY3fawZxuN+cAZoUr8:jl/i/R4TIBK4PvpbtDFVlvZxVZoUrnX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7883

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/BYTES.OEP

SHA256 3f16d1e840b2286347f213333640e94cc56b710fea175ae9f1629d352fb17d33
MD5 ba3dd49a09bc1fb6227b76dd2d70ca7b
SHA1 71f78365af25b1ff17b0f3affbde54db42505b2d
SHA512 7a0eacc0aa16b589332a4a76159eddb81f07e7a9ffc05522d37d2220c229fb173055614d7545901ce69879a58efc54aacc07a2dce7c76cb3693c55607edc61ae
MD5 SHA1 SHA512

ollydbg/Plugins/ClearUDD.dll

IMPHASH 71f56675c7d53187466580a02b7dbac8
SHA256 c3dc500b689d82a1d4b379b4a8dddf18e915d282ddf9c5296a3982e0432b812d
MD5 db63cd1b36753508d491291bf3ad193d
SHA1 5f0f837e28621c655a24ec47436ef10b83bcc002
SHA512 a747e953e69e7ae00519e2ba2f7669b297c80e7c779daa906842d0e6765593dc11475882385e996245f6f7866c71a77b631fc2df77ec584367a7689e6f6f0a18
SSDEEP 384:ktjGU09fTfccSOmZJJ8DiKSY/0X37zo+H8v7NHryhGekZrBuGRI+cX8og1gmhAML:kQVTfbW/J8L/E33PiHrVekZrBvRW8om
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/CmdBar.dll

IMPHASH 740c796cfe9487e35921d7ec5aad2eb7
SHA256 f8bdf6449c1ac4041717cd0e77d809fff3b2b6a735205b7988a174b7e0434b4f
MD5 59ba282190a4d81f3fe31b6886decb83
SHA1 8edbfd1055996ce2b0198ae782483c14f587ffc4
SHA512 a88e78b3de2bd1cc19b4f6c98e2696d2febbb03903012d411938bf6eacce40c0b5c09958b073d4e1b80edb2b5dac2dd867d6f7aad7bdfdef9fa2b801641e1813
SSDEEP 1536:i4Kj+hN0oZpFDdBjMbzxvqhlhsyo6iKeHnlHI542lGMGiHt:3Kj+hLZpldBu9vq3jolHu48
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg.exe

_Addtolist _Animate _Assemble _Broadcast _Createwatchwindow _Deletebreakpoints _Deletehardwarebreakbyaddr _Deletenamerange _Disasm _Dumpbackup _Expression _Findalldllcalls _Findlabel _Findmemory _Findthread _Getcputhreadid _Getstatus _Go _Hardbreakpoints _Insertname _Insertwatch _OpenEXEfile _Plugingetvalue _Pluginsaverecord _Registerpluginclass _Runtracesize _Sendshortcut _Setbreakpoint _Setcpu _Setdumptype _Sethardwarebreakpoint _Setmembreakpoint _Settracecondition _Startruntrace _Unregisterpluginclass _Writememory

kernel32

CloseHandle CreateFileA ExitProcess FreeEnvironmentStringsA GetACP GetCPInfo GetCurrentThreadId GetEnvironmentStrings GetFileType GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetOEMCP GetPrivateProfileIntA GetPrivateProfileSectionNamesA GetPrivateProfileStringA GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeW GetVersion GetVersionExA GlobalMemoryStatus HeapAlloc HeapFree LCMapStringA LoadLibraryA MultiByteToWideChar RaiseException RtlUnwind SetConsoleCtrlHandler SetFilePointer SetHandleCount TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree WideCharToMultiByte WriteFile WritePrivateProfileStringA lstrlenA

comdlg32

ChooseFontA

gdi32

CreateFontIndirectA CreateSolidBrush DeleteObject

user32

BeginPaint CallWindowProcA CreateWindowExA DefWindowProcA EndPaint EnumThreadWindows FillRect GetClientRect GetSysColor GetWindow GetWindowRect GetWindowTextA GetWindowTextLengthA InvalidateRect MessageBoxA MoveWindow ScreenToClient SendMessageA SetFocus SetWindowLongA SetWindowTextA ShowWindow WinHelpA wsprintfA

Name

.text

Size

45KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ollydbg/Plugins/CmdBar.ini

SHA256 6a268d70349168a4c88c0aef27fcf9986d8b9745973308476432b9a36bbf7403
MD5 ca0c5935aace83061fffc05998ae7519
SHA1 7761b0408d1f993f707e87cbbd3395335e80ee96
SHA512 7d9cfff4e35b8d3d3b413f685d7f1ce0eb0e68eee62df6096b788d114233f0f34c1a06613e05ff198d660109bb39edfe5fe6117c551a8af7f61a7612122500c3
MD5 SHA1 SHA512

ollydbg/Plugins/DataRipper.dll

IMPHASH 2d429d7c8db97ba30fcda6b5923d28c0
SHA256 1914a0136fc8c1fa1cca45496ebd59cc82789c64057f5df0fcc72da96f66c475
MD5 566f1d0f3293cb97f77490f3523f0442
SHA1 21921140f31bdf8eb9c0825386f670bcbd2c5e1f
SHA512 b6f04a5e3ef9755f9264cb38ee7e07465dc00a066ab3273f6757d8f9327a15c811dc7d8596536a0b7c646788653c2028c51de8079d3b77591bdf5b833e5c64ec
SSDEEP 1536:Sw54t8Ts0ZsRtR+eBSQ4SLnPBuEm3tTvvF49+z3fxPZR1P6fHNTk72k6nFpt+IjB:S6gXxMN0xSep
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gdi32

GetStockObject MoveToEx ExtFloodFill DeleteObject LineTo GetPixel SelectObject CreatePen DeleteDC CreateSolidBrush CreateCompatibleDC

user32

UpdateWindow GetDC SetMenu SetFocus SetDlgItemTextA SetDlgItemInt GetMenuItemInfoA SendMessageA RegisterClassExA PostQuitMessage MoveWindow MessageBoxA LoadMenuA TranslateMessage LoadCursorA LoadBitmapA GetWindowTextLengthA GetWindowTextA GetSystemMetrics GetSysColor GetSubMenu GetMessageA GetDlgItem GetCursorPos GetClientRect EndDialog DispatchMessageA DialogBoxParamA TrackPopupMenu SetWindowTextA ShowWindow GetDlgItemInt LoadIconA SetMenuItemInfoA DefWindowProcA CreateWindowExA CallWindowProcA wsprintfA SetWindowLongA

kernel32

GetFileSize lstrlenA lstrcpyA lstrcmpA lstrcatA WriteFile WinExec ReadFile OpenFile LoadLibraryA GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetModuleFileNameA GetCurrentDirectoryA DeleteFileA CreateFileA CloseHandle

comctl32

InitCommonControls CreateStatusWindowA

comdlg32

GetOpenFileNameA GetSaveFileNameA

shell32

DragQueryFileA ShellExecuteA

oleaut32

SysAllocStringByteLen SysFreeString

ollydbg.exe

ord89 ord92 ord2 ord101

ollydbg/Plugins/HiddenThreads.dll

IMPHASH fdc6cfbe54d6146201c4e82915b9fe6c
SHA256 b62f890797226199ed0812767d170b34aef1977b16bd0c887e2cc551705719ad
MD5 d32b352c9fab2feea13193503acd5d25
SHA1 1b1e03a3c2330126f755b836357e3fa059b40c70
SHA512 aacad90eaa4cec3cff533283cecb2c8eef5fc7bf6d10eb84a29b2b9ea12b85acd75bf581f9b68fa3144d2c020ed5287af317c8d35496c0e6e371427e55c29e61
SSDEEP 48:SkeCcWvuiEntlJGnlEibpV+nSu47uao+D8aj:3e5WvutyHbpVqSVo+X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/ICanAttach2.dll

IMPHASH 538e5ff3792b43ef5760ef69b48a08d9
SHA256 94c2c7d999273d3b01c22c327b03025e4c5fd83dca11f98fd2c3f224cfacb0c8
MD5 071b3c65cafcdf54c5fc7d24e9a5412a
SHA1 dc59d7adafefc38ecdf7efe5e5cfa6aba699ed3c
SHA512 dfa4f53a024713805b1b2d767fa91a336a020fbb257d0e0958ff1aa3bada1d0391ed6ba31fa2106742363c10117516e192576a3bffcdd58bdade9588a6671e61
SSDEEP 96:lyQJxLF5PZJKBegnQgmKFPdXlL066BKNPcJ:X5TgnQW5pPcJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/MnemonicHelp.dll

IMPHASH 8916a878f46c8ed1ce079322140be7e2
SHA256 884436231fc161349d054ffaead6597381689f1304a99f5875d285d7254b478b
MD5 cf1bef4978d4bec45372ceb5d1858d18
SHA1 3eb2d730f9327f0c856d38e5db68ed64f9f1e63c
SHA512 987d8dc90faf50bf6b527c5642371b671532344d807c009fdc4cb470296e64f744a25b6e3681d3f9af13f931c698ec32a85636cd20faaecaea287c6541b34a32
SSDEEP 192:FfXer4n6mrxNTeyGdxwqbjoM9IK3v3X+Eq/g3nF/0:Ra4blNTebdxlCEuI3a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/ModuleBCL.dll

IMPHASH 1878dc81f51673807650130c4df2a97d
SHA256 1c92c966efc690b183cb020eaf46c44d42358b582e8b656e2e115a584f33b3e1
MD5 be3daf92eef36093251bfad828a99a87
SHA1 7c977899da429993ec21f1a88b0d28878d268267
SHA512 6f9f1edb5e79bfe503ec076b6d7caf1d84c81350bf1e6172a881e1fdcfed0841233998d26040c19e09f64fabdcbb3a4f44a1ca463b27eaf5a8b2fcf3c3f138ae
SSDEEP 1536:F9N/SzVq/hyA2ISA7P4US+JXsfHMMumjNasnC8b9XpATaCA:MzVq/IIS+S+Bs57T
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\NetShared\C_Development\ModuleBCL\Release\ModuleBCL.pdb

ollydbg/Plugins/ODBJscript.chm

SHA256 de47aeffbbd652178c42bd97d629260c8ac2a2b3482e42d0ab31b3eaba334a90
MD5 c74debe014507186794447acdf30104e
SHA1 c38eb63127ca068d184a5ce81d29301992ba99de
SHA512 5c4d6302b2582a99a69378428747cb2b2122fd2e2ffa10cc267dff3311d9aef0068f30e8e1beec331c6a6ed786f1a9d106257e2cc258b910ac6ec6c5382f18c0
SSDEEP 3072:MGi7QGJSO66WT3Wi9iUGqxuqCwISdke/9nuUWnXG:MGSQb6WSCxQ9SVnTd
MD5 SHA1 SHA512 SSDEEP

ollydbg/Plugins/ODBJscript.dll

IMPHASH b2ba925dcc01a3b446c80b49b70db66d
SHA256 a9862066279f217da1676750e08009653440e91f6c2555523b33385162f3f708
MD5 e27579e37fc7a902dfe60b788940b4a4
SHA1 4939587fe3a4add1e3a4f0863b8ab6bed33e82af
SHA512 47d40e644ab7901b28075c1b6ab5971fbfa4a5a71e7730734af6bd8d846eafa4b039a5cd16464a2049ff2b7c3849020b21211329c1dd91f2a148e8f5a0f62a09
SSDEEP 49152:y0Pxk5qeO1/Krb3Amy3/TVxIvBmMku6D+M1wR4lbnOPqmubHjDviqp:y0BKrb3Amy3/TVxI/pmdE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

132070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTickCount lstrlenA GetProcAddress LoadLibraryExA GetModuleHandleA VirtualFreeEx VirtualAllocEx lstrcpyA CreateThread CreateEventA CloseHandle WaitForSingleObject PulseEvent VirtualProtect GetSystemInfo VirtualFree VirtualAlloc QueryPerformanceFrequency GetSystemTimeAdjustment GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange

user32

SendMessageA PostMessageA wsprintfA SetDlgItemTextA GetDlgItemTextA CreateDialogParamA GetKeyState MessageBoxA EndDialog

ollydbg.exe

ord27 ord170 ord7 ord12 ord1 ord138 ord55 ord121 ord142 ord140 ord63 ord141 ord62 ord177 ord183 ord79 ord147 ord150 ord144 ord67 ord68 ord145 ord149 ord152 ord25 ord123 ord116 ord182 ord83 ord59 ord155 ord112 ord33 ord65 ord143 ord82 ord81 ord171 ord136 ord41 ord43 ord156 ord97 ord96 ord95 ord94 ord125 ord133 ord132 ord23 ord45 ord3 ord124 ord161 ord174 ord179 ord2 ord172 ord60 ord53 ord107 ord5 ord88 ord117 ord44 ord101 ord77 ord176 ord135 ord134 ord47 ord48 ord52 ord139 ord20 ord127 ord128 ord17 ord19 ord110 ord126 ord54 ord130 ord158 ord102 ord181 ord166 ord168 ord167 ord8 ord180 ord4 ord164 ord34 ord84 ord99 ord115 ord78 ord35 ord85 ord73 ord93 ord90 ord6 ord186 ord39 ord74 ord129 ord165 ord10 ord11 ord157 ord31 ord32 ord46 ord42 ord169 ord24 ord108 ord109 ord185 ord106

shlwapi

PathAppendA PathRemoveFileSpecA PathFileExistsA

msvcr90

??_V@YAXPAX@Z tan sin sqrt pow log exp cos ceil _copysign atan2 atan asin acos fabs isalpha fmod localeconv strcpy _HUGE log10 _purecall memcmp strchr isxdigit tolower _fstat64i32 getc fopen memmove realloc calloc _fpclass malloc strlen strcmp strncmp _finite _isnan floor isspace _tzset _localtime64 sprintf strftime _set_invalid_parameter_handler strstr _setjmp3 getenv isprint bsearch _errno exit _except_handler4_common _onexit _lock __dllonexit _unlock __clean_type_info_names_internal ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null _malloc_crt _encode_pointer __lconv_init _itoa_s __iob_func fprintf abort fgets ferror feof memmove_s ??2@YAPAXI@Z ??0exception@std@@QAE@ABV01@@Z _CxxThrowException _invalid_parameter_noinfo ??_U@YAPAXI@Z strtoul memset memcpy_s sprintf_s fprintf_s strcpy_s fopen_s fwrite fclose memcpy ??0exception@std@@QAE@XZ ??3@YAXPAX@Z ?what@exception@std@@UBEPBDXZ __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ _fileno abs vfprintf fflush free isdigit

msvcp90

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?max@?$numeric_limits@I@std@@SAIXZ

winmm

timeBeginPeriod timeEndPeriod

ollydbg/Plugins/ODbgScript.chm

SHA256 c6854b4a85faff05ecaaf6d8a7f4e008ff07627047e62fe232e7709e67013d12
MD5 fcb5369b40993207f3f73c3b8193d662
SHA1 8dd243acfb03f8ee8d5bff59ece827c460287ada
SHA512 86593a18b2fd389c65b178a53a1e067b92f18873217a9a451783536242a8d6ae34accbd5da0e995a5fc3520b9653b59ec6c13874cc6c45b06bb88abcf7e2be3a
SSDEEP 3072:nv30WT8hJ4fcGIqh2j5LZlY/3CE8lsRv6bY6Tat:nv3LT8nsIqhW+/3Slw6Lw
MD5 SHA1 SHA512 SSDEEP

ollydbg/Plugins/ODbgScript.dll

IMPHASH 9dc65eadff077816f7e7fca07fceda80
SHA256 b6d752aea6b5ea346f35fc0a649aeb54284edc9d39bac1609a543634a9423c9e
MD5 f817294016a04e257edd8602a8a00e35
SHA1 42c227fe132ee2df80929b7f65fc1541b7e4c8c7
SHA512 7c178f4b0536b30aa34a29ae50bae133494d17496f1084591e22131193cd908ef0e6a09e18d05d76bf8fbd06c9d3764e3ff2d4d76e0027ff28206460bb2339fa
SSDEEP 6144:stBBo1ebpGy2I0F0nb39po/rVMUXdK2utAIPoywDm:stfpbpGpb0nb39ADXdKzqI8D
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

189193

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg.exe

ord27 ord160 ord170 ord45 ord144 ord75 ord61 ord42 ord44 ord142 ord128 ord129 ord19 ord23 ord175 ord149 ord24 ord165 ord77 ord127 ord169 ord25 ord117 ord5 ord32 ord174 ord48 ord13 ord31 ord4 ord161 ord124 ord39 ord102 ord141 ord109 ord106 ord10 ord3 ord157 ord33 ord186 ord60 ord11 ord131 ord78 ord74 ord1 ord79 ord89 ord107 ord87 ord113 ord114 ord46 ord28 ord73 ord71 ord92 ord2 ord12 ord100 ord65 ord105 ord104 ord93 ord108 ord88 ord101 ord53 ord172 ord90

kernel32

HeapAlloc QueryPerformanceCounter GetCurrentProcess SetFilePointer GetFileSize CreateFileA GetTickCount FormatMessageA WriteFile HeapCreate ReadFile GetLastError GetProcAddress GetModuleFileNameA GetModuleHandleA LoadLibraryExA QueryPerformanceFrequency CloseHandle LocalFree GetFullPathNameA IsBadCodePtr GetThreadContext lstrlenA lstrcpynA LocalAlloc RtlUnwind InterlockedExchange Sleep InterlockedCompareExchange TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetVersion GetSystemTimeAsFileTime WriteProcessMemory GetCurrentProcessId GetCurrentThreadId VirtualAllocEx VirtualFreeEx GetCurrentThread FreeLibrary HeapFree

user32

GetClassNameA SetDlgItemTextA DestroyWindow GetWindowRect CreateMenu PostMessageA DialogBoxParamA GetKeyState SetForegroundWindow LoadIconA SetFocus SendMessageA InvalidateRect GetDlgItem EndDialog SetWindowPos CreatePopupMenu DefMDIChildProcA DestroyMenu GetParent FindWindowExA ChildWindowFromPoint MessageBoxA GetDesktopWindow AppendMenuA IsWindowVisible EnumThreadWindows GetDlgItemTextA

shlwapi

StrCmpNIA PathFileExistsA

comdlg32

GetOpenFileNameA

shell32

ShellExecuteA

mfc42

ord1168 ord826 ord269 ord1116 ord1176 ord1575 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord6467 ord1578 ord600 ord825 ord823

msvcp60

?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??0out_of_range@std@@QAE@ABV01@@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0logic_error@std@@QAE@ABV01@@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ ?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??1out_of_range@std@@UAE@XZ ?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z

msvcrt

strtoul strncat strncmp ceil strstr _stricmp _itoa wcsncpy strtok fopen _ultoa toupper realloc _splitpath ??0exception@@QAE@XZ ?what@exception@@UBEPBDXZ ??1exception@@UAE@XZ _CxxThrowException _callnewh memset memcpy __lconv_init _unlock __dllonexit _lock _onexit ??1type_info@@UAE@XZ _XcptFilter _initterm _amsg_exit ??0exception@@QAE@ABV0@@Z strncpy tolower strchr malloc free sscanf sprintf _strupr __CxxFrameHandler strrchr

ollydbg/Plugins/ODbgScript.txt

SHA256 e8f383b9dc360def3374f0dea06f3110b46c1999352032b9755bd53a6f72d130
MD5 538a1726fbfd0f7e868e3013b53d1a2d
SHA1 7eaf20441aed4d690b331c2170230239b26c0e09
SHA512 6c8d09fcd5c361dff9f048d9099b65d7b12b94c4a6d2f948072731537662b60e3666439e878fe785e610ed6574402d4e64608d665cd031fed175e8d1dc03d49a
SSDEEP 768:w9FGnJB5GQmcay7GkVbdSfg07+9AnXteGCBhug7f:3nPEQP7FiRlCBwuf
MD5 SHA1 SHA512 SSDEEP

ollydbg/Plugins/OllyCopy.dll

IMPHASH e677f079ced7565adfb8787cea524604
SHA256 eedcf0ceacf6b8c18cce7292845b330d5ff9d34078f9264dec0c43210456f5e4
MD5 e5ef8ef1b0b3576b9c7388756e465dd1
SHA1 0a5dd30bd50c7651984728530d6e16986c432537
SHA512 647e7f1acadc6ba7b0f5947fff4d6284000337f3b787d6ce598775603521d5f9421c99ccde948263cf377e05e47e2733cc48eb8e3ef55f1f9cd0af63ace0c242
SSDEEP 384:rJ470DhXVCPleC4v6ePWpxDzcHXWLKPVmEAAJZs1s89j:ri+VMobPWpJzPLKdOAJC11j
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\rewrite\trunk\OllyCopy\Release\OllyCopy.pdb

ollydbg/Plugins/OllyFlow.dll

IMPHASH 506afa0cf48ee2fe0ef045543f83b1ca
SHA256 e5221887f6c2d6772899409d7b1f31106527c91ba58279b6ada86fcbaa016a6d
MD5 beff405fe2ee3f695df2326c316e6106
SHA1 dd1563d35762bd4fddcd49015f5d436d65d0877e
SHA512 9daae312e7ee891bb349a8d47f98530bdbfd3dda79d61e4150587931a678924b2a77543d2cfb8890db2c806b5fabc1d338bca8b66750b1856043fd058c540a50
SSDEEP 768:mkGXmGbo7lslcrH51h3TFqSraI05n5iwLh9VdBSnooUw/U4hsn2:mLXJoJs23TFqSrBInzLHzBroLU4s2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WritePrivateProfileStringA CreateFileA GetTempFileNameA GetTempPathA GetPrivateProfileStringA CloseHandle WriteFile FindClose GetLastError FindNextFileA DeleteFileA FindFirstFileA GetModuleFileNameA RtlUnwind FlushFileBuffers GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA MultiByteToWideChar SetStdHandle LoadLibraryA GetProcAddress HeapReAlloc GetCommandLineA GetVersion ExitProcess TerminateProcess GetCurrentProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree HeapFree SetFilePointer EnterCriticalSection LeaveCriticalSection InterlockedDecrement InterlockedIncrement InitializeCriticalSection HeapAlloc GetCPInfo GetACP GetOEMCP VirtualAlloc

user32

MessageBoxA

shell32

ShellExecuteA

ollydbg.exe

ord46 ord101 ord32 ord134 ord53 ord172 ord45 ord35 ord135 ord38 ord157 ord33 ord31 ord88 ord147 ord6 ord60 ord2

ollydbg/Plugins/OllyFlow.ini

SHA256 8a519baf5b772afb5eed72450dfb944485e8529559db4a45cbd9d51bbcd1c3d6
MD5 6ea8d8d5da8a601a28548aa1014e101f
SHA1 b22d859277c519856335ab58d6a3e6b8c1a3dea5
SHA512 6f68fec1e6557d31ed211f03e7c8a351332c220bab97e0961726b3b04c083b107e34a38da6c7cfab94e0b4306dfea89bcca312204ff650651642d852f064f192
MD5 SHA1 SHA512

ollydbg/Plugins/OllyWow64_0.2.dll

IMPHASH 1d254aa36703c1c16d4c10056b9be62a
SHA256 13ac858d99a2a5e75431f3d913603c1d6890a6845487bf05d2cfb876a4d03a50
MD5 402bef86d5cab24d5f3124bf91a28bec
SHA1 38eb61735c8d968675242542be129a0bbceb4a66
SHA512 be97374a920839dea05f54fb94e84686989f58495bae3b737f097d7191dee4a307cac0ff3436033324ea98a75daaa78ba0ce30618d0e62b5a1eb2734f9725246
SSDEEP 48:ad5gNA+rKulXvKoFp+0+HHCu45C2sPEPARcX:CIKu9vJjzKHC+fEccX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/RemoveCriticality.dll

IMPHASH bcff1c10d7554700edf51ff5bd2d4e6d
SHA256 c4356739502ba088dc2562c40195db2469437bee6ca20cf468e5c94c9a9a855e
MD5 b39116cbbc3fe0278d9ae20ba5ae661c
SHA1 1b54e2c3e52bd416deac712ad02f93121115a4bf
SHA512 f0c64eed3754ec7c7b2a7fb542dce0c5f64cef0762ffd4d64a021474be789de00e370cf19eb5b2228fbbabd176b9dbd86fb2235b410855158d21fb24d9575101
SSDEEP 48:a8Jea9K1d36fbr2ftgOpMH6u4vstsd2Ryl:HX9KfIXWxpI6ksEyl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/SehSpy.dll

IMPHASH 5174b6384cee56822c87f9a7b6e907b2
SHA256 fd822b904330d968e8c979851b1d4fb85ce247ca4d227fdf85e8b582b3110f14
MD5 3f565d432ddbe90e1a72a43f4bbe5f5c
SHA1 fa032db840dfa0fd084742d10162b3de695997e3
SHA512 beb58b46f39d8741b517258b2a615acd0167ef7aa61936b709d6b697e071ef8864c67cf6ab79c524fe0b2bbe081ded94935a24d7d61392b133b14f73c233ed14
SSDEEP 768:FnXBEPWtwXNf1B9lo9nSw4xfbusKO18jdMCUhRT2Ey+nxR5t68VT/O:FnXBmTdtBd8jdMhRTVnVt6Sy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6453

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg.exe

ord73 ord179 ord2 ord53 ord101 ord60

kernel32

HeapDestroy FlushFileBuffers CloseHandle CreateFileA GetThreadContext GetModuleHandleW HeapSize GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement Sleep SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP MultiByteToWideChar LoadLibraryA InitializeCriticalSection VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

MessageBoxW EndDialog DialogBoxParamW SetDlgItemTextW

ollydbg/Plugins/SigMaker.dll

IMPHASH 49d3ab3032ba61265825996cdb83ac8c
SHA256 287593136cfd9274aaacb65050c7f33cdafd114b5693271ba9f99a30d3bdce0d
MD5 eb0881d77468d0a439f5aac5214d261b
SHA1 8e8275864f3453c7503eeb3f987b95651b33a482
SHA512 c428409dd8c0fd99b55856fd2ae4182bae6619a868987508c40ea4a23f87badb16b19af8ed79854b349b6270f64ea3b0c974c1098ab08fbf8fdca3a4eaf7b590
SSDEEP 1536:xNBoIs+XqJul4qGdkyp2eQkMciTlcSwzO7KZv5PrGsb:xNB9aIBGxEx6lZv5D5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

12744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg.exe

ord78 ord31 ord2 ord101 ord98 ord107 ord45 ord92 ord89

kernel32

RtlUnwind GetProcessHeap SetEndOfFile HeapSize ReadFile Sleep CreateThread GlobalLock FormatMessageA GlobalAlloc GlobalUnlock LocalFree GetLastError WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA FlushFileBuffers SetStdHandle CreateFileA LoadLibraryA HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleA SetHandleCount GetFileType GetStartupInfoA CloseHandle GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar InitializeCriticalSectionAndSpinCount

user32

EndDialog GetDlgItem GetDlgItemTextA DialogBoxParamA SetDlgItemTextA MessageBoxA SendMessageA SetClipboardData OpenClipboard EmptyClipboard CloseClipboard IsDlgButtonChecked CheckDlgButton SetWindowTextA

shell32

ShellExecuteA

ollydbg/Plugins/StollyStruct.dll

SHA256 8246ee358436bb45047045d40302821ccdf0b2e3c764c02d235aa0dea30b93a3
MD5 9c54f588afd6c6110aee6972ee759e9a
SHA1 255da124a0769889d962e000aebbc675faaee9b1
SHA512 cc4959a44f6d08a315f68bea4eb757ed57850288ec8b524b079148f851e13b621957b74d3d35ce7ba53ac9bf1d7660f692008d3a6f125e0a65019d3eb3bcfaa1
SSDEEP 768:rNFp2fTYTV+ZB2aOZFnA6BFwadAOc3OkCjQc1XPo3e5KppMX+R:rEfETV+ZlOZFn5BhzKppMX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/StrongOD.dll

IMPHASH 4f46924c60bdf59293c42b8f6fa50dd9
SHA256 834d0e0486ad7d8cd319ba6ce559ad8b2fbede27d101b6996978b7f7dab8ee1d
MD5 7f198fe690d9c064f2dc9134cdd7affb
SHA1 a4a7ce3ef1b02ae04cfe909397b680f8134bb9a5
SHA512 5b8fdf6be7acf29adeacf274cb174fafe2564af74aec2cd4414448c334da9e47505f132ca91c6467f4726b7141126a042f002cd4d5fd358ace61aa943fe47375
SSDEEP 12288:Dxd5hom+lf1163vcNsHNaFgIcchKc5syIOl2T6bUHJ:Dxdf0f1163SGaFg/czxIOl2T6bGJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

42528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg.exe

ord179 ord92 ord98 ord78 ord59 ord38 ord93 ord27 ord185 ord89 ord186 ord76 ord85 ord2 ord45 ord84 ord99 ord115 ord46 ord90 ord31 ord25 ord4 ord161 ord79 ord175 ord73 ord117 ord172 ord171 ord75 ord106 ord101 ord124 ord152 ord173 ord180 ord108 ord164 ord167 ord169 ord155 ord5 ord42 ord23 ord53 ord170 ord174 ord109 ord60 ord104 ord114 ord91 ord54 ord107 ord88 ord44 ord36

kernel32

VirtualFree OpenProcess lstrcmpiA GetProcAddress VirtualAlloc Process32Next GetModuleHandleA VirtualProtect CreateToolhelp32Snapshot CloseHandle ExitProcess CreateFileA SetFilePointer HeapAlloc HeapFree WaitForSingleObject GetProcessHeap GetCommandLineA ReadProcessMemory CreateProcessA ReadFile FlushInstructionCache GetLastError VirtualProtectEx VirtualAllocEx ResumeThread MapViewOfFile UnmapViewOfFile VirtualQueryEx GlobalAlloc CreateFileMappingA GetFileSize Sleep MultiByteToWideChar DeviceIoControl GetModuleFileNameA GetCurrentProcessId GetTempPathA DeleteFileA Process32First HeapCreate HeapSize LoadLibraryA QueryDosDeviceA WideCharToMultiByte TerminateThread IsBadWritePtr GlobalFree OpenThread LocalAlloc GetSystemInfo GetCurrentThreadId OutputDebugStringA LocalFree GetTickCount CreateThread DebugActiveProcess GetThreadContext SetThreadContext MoveFileExA GlobalLock GetCurrentThread CreateRemoteThread WriteProcessMemory VirtualFreeEx LeaveCriticalSection GlobalUnlock CopyFileA EnterCriticalSection ContinueDebugEvent WaitForDebugEvent GetVersionExA WinExec SuspendThread WriteFile MoveFileA GetCurrentDirectoryA SetEndOfFile FlushFileBuffers SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount RaiseException GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetConsoleMode GetConsoleCP RtlUnwind LCMapStringW LCMapStringA SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCurrentProcess InterlockedDecrement InterlockedIncrement GetCPInfo GetStdHandle GetModuleHandleW DeleteCriticalSection HeapDestroy IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapReAlloc InitializeCriticalSection VirtualQuery

user32

GetDesktopWindow EnumChildWindows PostMessageA OpenClipboard MessageBoxW EmptyClipboard SetForegroundWindow SetClipboardData CreateMDIWindowA GetClipboardData DialogBoxParamA InSendMessage GetClassLongA GetWindowLongA GetWindowLongW GetForegroundWindow GetClassLongW LoadImageA MoveWindow GetWindow GetKeyState CloseClipboard EnableWindow CallWindowProcA SetWindowTextA DeferWindowPos ShowWindow GetSysColor DefWindowProcA CreateWindowExA InvalidateRect SetWindowLongA GetWindowTextA BeginPaint DestroyWindow GetMessageA SetTimer PostQuitMessage TranslateMessage UnregisterClassA SetWindowPos DispatchMessageA GetSystemMetrics LoadCursorA RegisterClassA SendDlgItemMessageA DrawTextExA ReleaseDC GetDlgItem EndDialog CheckDlgButton IsDlgButtonChecked GetComboBoxInfo GetDlgCtrlID GetDlgItemTextA SetDlgItemTextA UpdateWindow SetProcessWindowStation OpenDesktopA CloseWindowStation GetProcessWindowStation GetUserObjectSecurity CloseDesktop OpenWindowStationA MessageBoxA SetUserObjectSecurity SendInput WinHelpA wsprintfA EndPaint ScreenToClient GetWindowRect FillRect DrawTextA GetClientRect SetFocus GetWindowTextLengthA SendMessageA GetDC

gdi32

SelectObject DeleteObject SetBkColor GetObjectA GetStockObject CreateCompatibleDC DeleteDC BitBlt SetTextColor CreateSolidBrush

comdlg32

GetOpenFileNameA

advapi32

GetSecurityDescriptorDacl LsaFreeMemory LogonUserA GetLengthSid BuildExplicitAccessWithNameA AddAce FreeSid RevertToSelf AddAccessAllowedAce AllocateAndInitializeSid InitializeAcl SetKernelObjectSecurity MakeAbsoluteSD ImpersonateLoggedOnUser LsaClose DuplicateTokenEx GetAce LookupPrivilegeValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor CopySid CreateRestrictedToken GetAclInformation GetKernelObjectSecurity GetTokenInformation LsaEnumerateAccountRights LsaOpenPolicy SetEntriesInAclA OpenProcessToken CreateProcessAsUserA AdjustTokenPrivileges LookupPrivilegeValueA IsValidSecurityDescriptor SetSecurityDescriptorOwner ImpersonateSelf AccessCheck SetSecurityDescriptorGroup OpenThreadToken ControlService OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService CreateServiceA StartServiceA ChangeServiceConfigA

shell32

ShellExecuteExA

netapi32

NetUserDel NetUserAdd

shlwapi

SHRegCloseUSKey StrCmpNIA SHRegWriteUSValueA SHRegCreateUSKeyA

imagehlp

CheckSumMappedFile

psapi

EnumProcessModules GetMappedFileNameA GetModuleFileNameExA

wininet

InternetCloseHandle InternetOpenA InternetReadFile InternetOpenUrlA HttpQueryInfoA InternetCanonicalizeUrlA InternetGetConnectedState

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

HookStub

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.fengyue

Size

169KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ollydbg/Plugins/TLSCatch.dll

IMPHASH b6e2a6cc8bbb3d1f057799a715ded087
SHA256 5d2ff7bffba65c6bc9f33c127b0e137cfcfec17aae34d17408783bb051b9bca0
MD5 dc1bb1f623960943e708b0fe93f3c4bc
SHA1 ba2f3e55b90d9cb96330732bacea1196c8e82665
SHA512 c7d6a1d7c07521f9dc87278b081d6049aeb74d08c66d032b27e4a387bba6ef206621411795a14a93f85a053d2f6b00aa1455253a1de807af11d40f110af4720f
SSDEEP 48:C04SrjzFrD2u0ckDYo9rVKG+4cIowOhBbeMXPDylPDlSSvsA08kWaZfpDt0nv0yd:qS/h3mP/HfPAiZsvfphAvLXfX0bYI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/X_CRYPTO.dll

IMPHASH ed0bfc41a1451e7cb0633c9f9808272a
SHA256 07422fe7813726da79ffe3d9f3f6af5e516ea7525725e6ea1ee3f0e9790c474f
MD5 76051289b0262bdaeb7b66e466368b8f
SHA1 8be7ea99bd82e087a28b0f44b85bf01595a42669
SHA512 d1ac154f42a4195fc4632bf87b139ad3492ada7c6bcabbdee6c4f37932b724ddf9036cb5e087ea3971df565b73c82adda1f281741b39dd8e60b461d4d461aa90
SSDEEP 6144:1Kz/BKs/7WDo5ifjCCGsl/ww5tDIgEB49BSZ7PC:Ez/BKAsowzDIgF9MC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

720400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

ollydbg/Plugins/analyzeThis.dll

IMPHASH d6bab4d05b422a00b330bc99e484138f
SHA256 fd67ae2ba9394c251c95e04c9bcc0c1fdb8d3c53191299dfb846d1bf1ab7e704
MD5 4c815ff7eddbd5a88773beb11bad097f
SHA1 9498e0851459b0fc103f12c97fb24c256d8b6705
SHA512 572a4a5a2be1a1c80a59a05e8eb4796d9d8c3b4887f0901c6e003e30cb1d6ba8ee3cfd75a0187ae8e94c124db733c58c7ca9fbe1f72713a156de08cff6a6ecad
SSDEEP 192:nE7LwVbD4cdNWeyosYRsUyATtTvR9nvb5EOOC:E7SkcdQMlRXNrIC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

166B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

396B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ollydbg/Plugins/ida_sigs.dll

IMPHASH eab28f219972a2cb39654c24603af1d1
SHA256 1337646819c0c53da21ba441aeb7f44bd426cc22073619f2330037d2bd6c5a81
MD5 7b52f936de7a0cfd615938591687eb06
SHA1 860f8f47bdaa2ade90e997ccff2b3cf235279852
SHA512 8fb12c574f09bb1df7a6048ff16c7828e00453ffe6faf688d583198843bc11df08cddf3da1b85de6ea7f06883ea6564e1c92fce35cd529da7b7ae8a4632a913f
SSDEEP 192:1Eq14/WAw5ngL+RfNKtpDSPJt1quVzbU3qdg/pfpE84ft:1Ef/WlhU+AqJt1quVzbUGgRfeft
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Plugins/ida_sigs.ini

SHA256 d6036d5b6f96d958e3c06af6d32ee1d1a7ae3ef322b5452bbc31f3b9efc49d82
MD5 f698ba806270b0b6ae1e2382d058b1eb
SHA1 b4181b159e22f95d42a84ae4d52b554b452c8593
SHA512 3480b72efcbe707152137d6314f9902bbe5cd37dea0eaf12a4055fcbf6283266ce84adafa1b33834a9b880a616c96285eaaa203a5a5a5983e2be62709a888238
MD5 SHA1 SHA512

ollydbg/Plugins/idaficator.dll

SHA256 e70802ae644ae146764aa850608af8344b5ae2308a3776215b9b8adad91e1fc5
MD5 3ff5a0b354b07d26aa9be6c054f5afd3
SHA1 8837c1143202051085693ec20b9d686d7f264ed2
SHA512 613eb9ce53df947ff00052517ef260a5543d53085907bd1da46144c8d2fddb6944666132ea5d7edfdc31903418152f229eaed3f72ac78422a94d2065e28f9a08
SSDEEP 6144:uhqbqCq9umZbPt4IRu4OH2ZDR0Pz7TatrFgNziMV+:CqxqomZT3o4PD2DatSNzi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

633840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 f17a12d4a054a79173ccbde5935ef9b8252514f55e683081a8dd88675160bfd0
MD5 b064e5e10556b1d42b6c22d496019533
SHA1 32b0f0516e6237f9bcdd133aac5773cd2574467e
SHA512 f115d36ed42a7aa5dd3e0dc24ca6c11962a637944431dcdcdf569ffee630a468697464fcd535d078bfa4c53827163bb2fa8f4a7ffe9201abbd9e6c33dffb63ac
SSDEEP 12288:j1mxPGFe3+tw4Aa6UeU47Wl51aS4EeKVZZEjpJ/UnwJWrrNFFFFFFFFFFFFFFFFH:j1mxPGFe3+tw4Aa6UeU47Wl51aS4EeKn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

175KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

577B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

309KB

Virtual Size

309KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ollydbg/Plugins/multiasm.chm

SHA256 a6bc89548cfa8c2dbe4ee49f67f5c12c378be25f8c63bde95425cd251336710e
MD5 8c26547edfbf0627ae9ed1de77f60056
SHA1 36bf76e8a06eddb70d6b02ce6e96cd1494cfc6fa
SHA512 424fe308ff97808909ab8ef1629e8eec2b0e705401eca34a0ed0f09be9019f0625c3c323efda807804a967e157924cee137ac1a6c38978471985740a6a3467e7
SSDEEP 6144:timsI8XGbgaTwZvyHsLxbN7uKPc0sdpLfrs3GcCfkYUxDxLX:dsEbXTwZaHqxbBzPcHLf42cCfBUxDxLX
MD5 SHA1 SHA512 SSDEEP

ollydbg/Plugins/multiasm_odbg.dll

IMPHASH 8500dad885776caa8c0e2656758c2d7b
SHA256 44a22052c681cb8dd088d0820b620084cb3a5d67b98aa5d831c05b2dce070eba
MD5 9902e40190f0020ced7e3ba8eacb1c62
SHA1 f76b5c6d13d3124e5368e6a2a181179ccb236a38
SHA512 b14b55347813c1e5f370297c56ee5c685ba0bee57625d1e67933327434ca2dd2f0c8e3a44477b3941d8e1fc6de9698ebe31204aa9eb86d4747f33598c505519c
SSDEEP 3072:Wd8roSx5pBE+/cuSn//uhGXmJoApm0kVn6YGgp2QRJD4jbytIb:Wd8ro+XBE+/A//1dARon63ggoN4X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

20336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

InitCommonControlsEx ImageList_Destroy ImageList_Create ImageList_AddMasked ImageList_Draw

ollydbg.exe

ord2 ord90 ord44 ord45 ord38 ord89 ord101 ord31 ord4 ord170 ord88 ord73 ord136 ord92 ord117 ord99 ord93 ord84 ord25 ord46

kernel32

lstrlenA WriteFile GetPrivateProfileIntA GetFileAttributesA ReadFile lstrcatA CreateDirectoryA FindFirstFileA lstrcmpA FindClose GetPrivateProfileStringA WritePrivateProfileStringA MoveFileA GetModuleFileNameA GetTempPathA DeleteFileA DisableThreadLibraryCalls HeapReAlloc InterlockedCompareExchange GetTickCount GetCurrentThreadId MultiByteToWideChar ExitProcess GetLastError GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapCreate HeapDestroy RtlMoveMemory WideCharToMultiByte CreateFileA GetFullPathNameA lstrcpyA CreateThread CloseHandle WaitForMultipleObjects CreateEventA GetProcessHeap SetEvent WaitForSingleObject HeapFree HeapAlloc lstrcmpiA

user32

IsWindowEnabled LoadMenuA GetSubMenu IsIconic TrackPopupMenu SendDlgItemMessageA PostQuitMessage CreateDialogParamA GetWindowRect SetFocus SendMessageA ClientToScreen RedrawWindow ScreenToClient MessageBoxIndirectA DialogBoxParamA IsDlgButtonChecked CheckDlgButton EndDialog ValidateRect GetDlgCtrlID CallWindowProcA IsWindowVisible ReleaseCapture UnhookWindowsHookEx SetWindowsHookExA ReleaseDC DragDetect SetPropA GetWindowTextA GetCapture GetDC FindWindowExA RemovePropA CallNextHookEx GetParent GetFocus GetPropA SetCapture BeginPaint CharLowerA CharUpperA ChildWindowFromPoint CloseClipboard CopyRect CreateCaret DestroyCaret DestroyCursor DrawTextA DrawTextExA EmptyClipboard EndPaint FillRect GetClipboardData GetCursor GetCursorPos GetKeyState wsprintfA GetSysColor GetSystemMetrics GetUpdateRect HideCaret InvalidateRect IsCharAlphaA IsCharAlphaNumericA IsClipboardFormatAvailable KillTimer LoadBitmapA LoadCursorA MessageBeep MoveWindow OpenClipboard RegisterClassExA ScrollWindow SetCaretPos SetClipboardData SetCursor SetScrollInfo SetTimer SetWindowTextA ShowCaret TabbedTextOutA UpdateWindow WindowFromPoint RegisterWindowMessageA PtInRect IsDialogMessageA TranslateMessage GetForegroundWindow GetWindowPlacement SetWindowLongA MessageBoxA UnregisterClassA GetWindowLongA CreateWindowExA EnableMenuItem TranslateAcceleratorA GetDlgItem DefWindowProcA SetWindowPos LoadAcceleratorsA GetCaretPos ShowWindow PostMessageA DispatchMessageA DeferWindowPos SystemParametersInfoA BeginDeferWindowPos LoadImageA MapWindowPoints EnableWindow DestroyMenu DestroyIcon EndDeferWindowPos GetScrollInfo GetClientRect RegisterClassA GetWindow DestroyWindow GetMessageA

gdi32

CreateRectRgn CreateSolidBrush DeleteDC GetDeviceCaps GetObjectA GetStockObject GetTextExtentPoint32A CreatePen LineTo MoveToEx SelectClipRgn SetPixel SetTextColor TextOutA CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontIndirectA GetTextMetricsA DeleteObject SetBkColor SelectObject SetBkMode

comdlg32

GetOpenFileNameA GetSaveFileNameA FindTextA ReplaceTextA CommDlgExtendedError

shell32

ShellExecuteA

ole32

RegisterDragDrop DoDragDrop RevokeDragDrop

ollydbg/Plugins/oDump.dll

IMPHASH f9a1512dd7dd1f70139d21e0e5ad2c96
SHA256 ed170b8f58da5c8ff6d33a7d7f488bf97f70b8a5670d5b8670b752f1f44d548d
MD5 1aed3d6720b1dcf0506be03319e8e12c
SHA1 e2fd1a7c149546cc92a355fbac5c9f672978ed14
SHA512 291dd6a680c7e20f06405ca52c6bfc6c3c9950947d16e448e112a7b7e6714c424c5fbf8ce16448e4cf9ffb45f4b613dceaea180856bd33c53746b89b91510a37
SSDEEP 192:HH5K74qkAb6n6arG+pF2nPfDYeeV0KiAff:n5Ks6gF2nHDYTNf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ollydbg/Readme.txt

SHA256 c6a19a0d2dd96548a80f7e7686ae38f1163a7345e90069a6214bc91344a94d4a
MD5 77a890532f2b5f9613e2ed455c7fd198
SHA1 7a355de597e22733312008bab832e197569179b5
SHA512 a606651036e488e2cb4dea3b6d53a2c5bc3e4ff5964c9c83ad7ab5b78d28512480506307a1829b991599fcd8754fc88ecbf6dde359a759873a38c186af2eb784
MD5 SHA1 SHA512

ollydbg/StollyStructs.ini

SHA256 5002de3ab05aac69ea1298d6d8e81e94c0f291190a3b84ab709c1c8d3ec8231b
MD5 eaf9f00570d787b3e2ff7556b0611459
SHA1 10545083adbeb54a0caca97c01535adaef182d32
SHA512 c07f6715af4495f2929418cc10f4c8855b406425697114a1605d7c0b23bee15676dd0f822650fdcb8e01bce36adccccfbcb6bd111b15669e619994f783198763
SSDEEP 1536:RPbiqH+KdljsBMClfjbenhRTwAS3VnNMxPhCntPI2Mku0N8DGLE718Bf0C:RGqH+KdsMClbbyhRTqxRG2Mk86LE+BsC
MD5 SHA1 SHA512 SSDEEP

ollydbg/dbghelp.dll

IMPHASH e246e1939eedffac25310343ba57d266
SHA256 cbc2285624088f24550bac9e5c56624ca72f1c3cba3bd51e55f50aafa409581c
MD5 379afd26403cca7908f4b39c1ad0a86c
SHA1 3e787ac853c7608b725a2020380ed2364cb00f04
SHA512 2e3236277254e351ccb5b189f1dedbea7a9688690c661b6ef602cc4969a435d762693a83b894573e732595b714f36428189bdd330b875991f9cbcc09416a588a
SSDEEP 24576:M6POl20g8okw6NAwZ34s+m1cGOAGtPU7MfKQlpRZgExz0bUfcUWGs1sxf3oONHS2:TbmeGOAGtPU7MfNTE5b8WGscf3oOt5
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

53:12:dc:61:b5:ac:22:99:f7:b3:0a:4c:f8:7c:8c:75:88:08:11:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 8, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0f:78:4d:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 23, 2007 - Feb 23, 2009

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:47:52:ba:00:00:00:00:00:04

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:49:7c:ed:00:00:00:00:00:05

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 16, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

1

Major OS version

6

Entry point

429345

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dbghelp.pdb

msvcrt

_isatty _write _lseeki64 ??3@YAXPAX@Z _fileno _read __pioinfo __badioinfo ferror wctomb _snprintf isleadbyte mbtowc _onexit _lock __dllonexit _unlock _ismbblead _amsg_exit _initterm _XcptFilter memmove _iob __mb_cur_max strchr _vsnwprintf _errno __CxxFrameHandler iswspace calloc _itoa _wcsdup towlower tolower _wcslwr time _wctime _ltoa _wcsnicmp _purecall ctime malloc strncmp isspace _stricmp _strlwr free wcsrchr strstr memcpy _wcsicmp qsort wcschr wcsstr wcsncmp iswxdigit memset ??2@YAPAXI@Z iswprint atol fclose __unDName iswdigit _CxxThrowException bsearch _wfsopen fread fseek wcstol _wfullpath _wgetenv _get_osfhandle _chsize _close _open_osfhandle ftell _memicmp _mbscmp ??1type_info@@UAE@XZ _wsopen

kernel32

HeapAlloc MapViewOfFileEx GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount GetFileType DeviceIoControl SetFileAttributesW CreateFileMappingW InterlockedIncrement InterlockedDecrement LocalFree FormatMessageW SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetTickCount QueryPerformanceCounter RtlUnwind InterlockedExchange GetThreadSelectorEntry CreateThread TerminateThread VirtualQueryEx GetPriorityClass GetThreadPriority GetThreadTimes GetThreadContext ResumeThread SuspendThread GetCurrentThreadId GetSystemTimeAsFileTime Sleep GetVersion GetSystemInfo LoadLibraryA InterlockedCompareExchange DelayLoadFailureHook ReadProcessMemory GetProcessHeap GetFileAttributesA SetErrorMode WriteFile OutputDebugStringA VirtualFree OpenProcess GetCurrentProcessId GetModuleHandleA CreateFileMappingA MapViewOfFile DuplicateHandle VirtualAlloc VirtualProtect CreateDirectoryA UnmapViewOfFile GetCurrentProcess SetFilePointer IsDBCSLeadByte HeapFree HeapReAlloc GetVersionExA InitializeCriticalSection HeapCreate FindClose LocalAlloc SetLastError LeaveCriticalSection EnterCriticalSection CloseHandle ReadFile GetFileSize CreateFileA GetLastError TlsSetValue TlsGetValue TlsAlloc TlsFree DeleteCriticalSection HeapDestroy FreeLibrary FlushViewOfFile

DbgHelpCreateUserDump DbgHelpCreateUserDumpW EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx MakeSureDirectoryPathExists MapDebugInformation MiniDumpReadDumpStream MiniDumpWriteDump SearchTreeForFile SearchTreeForFileW StackWalk StackWalk64 SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymCleanup SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrW64 SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW UnmapDebugInformation WinDbgExtensionDllInit block chksym dbghelp dh fptr homedir itoldyouso lmi lminfo omap srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

ollydbg/dumpsig.exe

IMPHASH 8bf34dcdfa93f98f3177dcd2182f65fe
SHA256 5503be0fddb2bcc560721a261972dacb15d8e81d43a9d5dec91709f7de6b00f2
MD5 3b29adff4789a42e4d393389c011848a
SHA1 efea00281633834ed76808211d89d60e95191766
SHA512 8090133737a0ad07a8ba42591c7826437b3d58a6912303eadfc4b48b80d24b1f1ab41bfcbf080c8f7de2daf5681885147e958e9ecc1e7ab4a4e68112c9dfa07c
SSDEEP 3072:AcH1IBopuMj0IcCSGGqd3lE79w9BJuTBftnPPrU:HpuMj0IcCNL3AgB4TBVnP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

__GetExceptDLLinfo ___CPPdebugHook _append_snprintf _auto_display _callui _dbg _debug _errprm1 _errprm2 _errprm3 _errprm4 _errval1 _errval2 _errval3 _errval4 _qerrno _qmakepath _qsnprintf _qsscanf _under_debugger create_hit_counter ecreate ecreateT fopenA fopenM fopenRB fopenRT fopenWB fopenWT freadbytes free_idasgn fwritebytes hit_counter_timer ida_checkmem lread openM openR openRT process_zipfile qalloc qalloc_or_throw qatexit qbasename qcalloc qchsize qclose qcreate qdirname qerrcode qerrstr qexit qfclose qfgetc qfgets qfileexist qflush qfopen qfputc qfputs qfread qfree qfseek qftell qfwrite qgets qisabspath qisdir qmake_full_path qmakefile qmkdir qopen qread qrealloc qrealloc_or_throw qseek qsplitfile qsplitpath qstpncpy qstrdup qstrncat qstrncpy qtell qtmpfile qtmpnam qveprintf qvfprintf qvfscanf qvprintf qvsnprintf qvsscanf qwrite reg_hit_counter sanitize_file_name strrpl verror vinterr vqmakepath winerr zip_deflate zip_inflate

Name

.text

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ollydbg/ico/BUT_IMG_COSTUM1.bmp

SHA256 a01728f46bd2ea6f773c45c71ec31a75858023c8d8738b2c238842c0c7cc0dc0
MD5 a9b4e130c97914265a93e38f6dd8d09d
SHA1 1d05a8af0905a5e9d909a203c5da59b0bb4b6455
SHA512 84b39d242ab98091cf1ef746eabcf070f91ffedd70a0837543ade9549029a428e1dd52307c4e379bb30fa8ba0d7531917d543ffe89cb5031f451b28f9fd87d5d
MD5 SHA1 SHA512

ollydbg/ico/BUT_IMG_COSTUM2.bmp

SHA256 7fb64e30b734721ac965f8ccc32192438e0ca112c44f424ce8c7a65fe7b7b23a
MD5 68086d9072a95ca53d858e8986968ea4
SHA1 a02d43d1f1f0c5d4751ed7937ca6e490536b0d15
SHA512 c54f7093f501d6aca9274b416be4fcdfb5a2c58a79653b4fa862293ee847b7e7b0e55969d7cfaf4708c077f8130a1da5f7e47d7d4ad41ef7b15274f4fc0f105e
MD5 SHA1 SHA512

ollydbg/ico/BUT_IMG_COSTUM3.bmp

SHA256 8bb3410f6165487206bef5121f0ecaa03ed1d123ab1f7d11323007b884c3f0fe
MD5 4760d737698d910452c95981c66519cd
SHA1 557313dbb0b8a29d682ed6c415f5dcd9413ae940
SHA512 03257217b2922e9018ef2266997009a5e90256113e21cb4083fae7b6f5502019cc531f55416879d73ac46b1634cc23041e4a0936b67232ecbc4e81bae1de56ad
MD5 SHA1 SHA512

ollydbg/ico/BUT_IMG_COSTUM4.bmp

SHA256 cc9c68bcd497fea1e606ab99370bd0265b5f2d647b9d2018227993784e362ff3
MD5 2b4d229b10bef193f852a6b3635f0555
SHA1 39afe0fe36b3dc27e9d16df79ed965dc99838778
SHA512 54620c7d0c7ee314db2da85c51b9d8a701c8e655f1ea8b936c448e60f9001b25a171b754fe1592383c31dc9b8e5f1cd0fb7f677ab245d397b32ce349ccfc85c8
MD5 SHA1 SHA512

ollydbg/ico/BUT_IMG_COSTUM5.bmp

SHA256 eb60111128a417689a2f5d6b4a82ec57f2264ca3855dad209b33dad20853afd8
MD5 4e7a0a016df0b31722ab3c8a10aeacf5
SHA1 d27f2548720de4a00089017214bb2fa01fab1318
SHA512 17e618b96b4ea8917af26e5a4f1c9630b40847fa9c12949747968ae2c9de76547218d42bc23c435f4f288cca758b7a4e50885f505a26b2e9ac51393497a3f859
MD5 SHA1 SHA512

ollydbg/known_bugs.txt

SHA256 9717a729e81978754edf612ad949ffdcc85f5223c4dd17fa3e1fb0744c9a2552
MD5 fe00ad4c2bc7ef974f2cddc7c25f598a
SHA1 600c43391ff59e332ccf02cac2fb629da7489dd8
SHA512 e50cddb560034a03e50d98bcb3f2d8bf619452eb9fac0a35e952bd57c0ddbfc255c9383a1e18b204f57b89b9b4830f77f2d9a47cd57b75d5877222029ab6be7c
MD5 SHA1 SHA512

ollydbg/loaddll.exe

SHA256 21db5b1c36e9b65423f28db4b3aa435af9726ef3a62635852d750642648f8a31
MD5 5538e8a4bebb575d2c60850fba116c97
SHA1 a2b83a5e3b0a1df15a28b2d858f042856ea33ce2
SHA512 830deb9c5f8ead74229e135cea941791c1f86976275b338221503058160c99dfb886c0f9ae12525950def92410b9aabf6375575627b388557ead6e376201eacc
SSDEEP 48:OEP9PqPbKMqDs1zzNmiRycSB0rpuDvzftxz2BQLct0k:nPwl1giRUmrgLzftxCBCcX
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

65648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

ollydbg/ollydbg.ini

SHA256 33c0e4e5e757ffe30bedad99c6969b6385220d4edc44a12c1d0d366f98f69043
MD5 b28c93f99161f6031b57cc4ce3fd1c3d
SHA1 769a57f11e54aa14025c26d478cd3ed27a02a661
SHA512 22d8279433fb16eb2659565b0f9cec911a51f72f9a5b46680aab0931837665587a4eaedba248c6cc4158aca3e517eb4192788861185b83841b2a5663f662ae2e
SSDEEP 384:qXhOjFfJGV+Ltuh+TASs471kXp/cjHSVjBQYYX:qxOHch+2C1kZ/yHSxBQYYX
MD5 SHA1 SHA512 SSDEEP

ollydbg/ollydbg.js

SHA256 9c08c45faeaa4b05e2b840d969ba5cc985d55c2d109c2a984d9ac9407c981225
MD5 c73741eb8b056a65a1c03c639fd57355
SHA1 120653fbd748f117a2b3c304eaa295ae3dee6c12
SHA512 ee4e6a84206bbf75c00b531b0a8fa3b367b82dcf7c0b08a54dee3c67b122f7d8aff6eaee4d0cb1dfd7c375d121833118c4fb934715d922a5fff566e9ae032664
SSDEEP 192:KcXAHYbAX3S7JYH0eAKjil0ZKkM6iaMKpjlN9+8fRFPeUDT2r2Wv/H2Jh5v2UZo7:OnSdlDKpZHvjr5leFXveJzvc
MD5 SHA1 SHA512 SSDEEP

ollydbg/win32.hlp

SHA256 511c068fea8c3c31b0ebccd0811ed96bce7b685a31d421605228ba757cfb9a23
MD5 ccb83a2ed1d620209c1b7b688c79ee0a
SHA1 1ddddb2e57813df5435d85ddec389658d4cb5897
SHA512 fed5885328b8c8202405ba704159e04321c63f696e9fb0cd49298bd610e65c7ebc09faeba54ce4c538a8d1d0bc398231ed5e47d3c4581b562af56dade09c4b45
SSDEEP 196608:Cb4jTflMO2alzsg26mm2P+nnqvUWakvOTEkMV:Cb43f1lQg26mm2GnnqvUWakvAEkMV
MD5 SHA1 SHA512 SSDEEP

ollydbg/wingraph32.exe

IMPHASH bb0acc175445092f0866df67c282ef0a
SHA256 7601a98d7e1fa0b8085b8da899ddf8c8ecf471c9664a19bdd32fad7278a8f381
MD5 e5c8d342450415583ab35028b7b671a4
SHA1 747d30cbbb46cbe5976ec8cadf5b0a3066872d54
SHA512 9bd32222faa0464e79c921dd8eef5e364ed0fdcdd09efe23bc40b7529171e7a70b92d8402b4003fa44cab727f32ea3b750b6c2db675a7d6a10908c67174e11a7
SSDEEP 12288:SlfQlfjZTb5vbtYiKEkIlxfAfR9lVcM6iG+MViayYp/mRUaZAawuHitosxWEv7yX:X9Tb1+iKD4+ZjGzXyYp4fRLibxZ7y
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegFlushKey RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CloseHandle CompareStringA CreateEventA CreateFileA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection EnumCalendarInfoA ExitProcess FindClose FindFirstFileA FindResourceA FormatMessageA FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetDiskFreeSpaceA GetEnvironmentStrings GetFileAttributesA GetFileSize GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetProfileStringA GetStartupInfoA GetStdHandle GetStringTypeExA GetStringTypeW GetSystemInfo GetThreadLocale GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GlobalAddAtomA GlobalAlloc GlobalDeleteAtom GlobalFindAtomA GlobalFree GlobalHandle GlobalLock GlobalReAlloc GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement LCMapStringA LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadResource LocalAlloc LocalFree LockResource MulDiv MultiByteToWideChar RaiseException ReadFile ResetEvent RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetHandleCount SetLastError SetThreadLocale SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpA lstrcpyA lstrcpynA lstrlenA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

winspool.drv

ClosePrinter DocumentPropertiesA EnumPrintersA OpenPrinterA

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIconSize ImageList_GetImageCount ImageList_Read ImageList_Remove ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_SetIconSize ImageList_Write ord17

comdlg32

GetOpenFileNameA GetSaveFileNameA PrintDlgA

gdi32

BitBlt CombineRgn CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDIBSection CreateDIBitmap CreateFontIndirectA CreateHalftonePalette CreateICA CreatePalette CreatePenIndirect CreateRectRgn CreateSolidBrush DeleteDC DeleteObject EndDoc EndPage ExcludeClipRect ExtTextOutA GetBitmapBits GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDCOrgEx GetDIBColorTable GetDIBits GetDeviceCaps GetObjectA GetPaletteEntries GetPixel GetRgnBox GetStockObject GetSystemPaletteEntries GetTextExtentPoint32A GetTextMetricsA GetWindowOrgEx IntersectClipRect LineTo MaskBlt MoveToEx PatBlt Polygon Polyline RealizePalette RectVisible Rectangle RestoreDC SaveDC SelectObject SelectPalette SetAbortProc SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetMapMode SetPixel SetROP2 SetStretchBltMode SetTextColor SetViewportOrgEx SetWindowOrgEx StartDocA StartPage StretchBlt UnrealizeObject

shell32

ShellExecuteA

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginPaint CallNextHookEx CallWindowProcA CharLowerA CharLowerBuffA CharNextA CheckMenuItem ChildWindowFromPoint ClientToScreen CreateIcon CreateMenu CreatePopupMenu CreateWindowExA DefFrameProcA DefMDIChildProcA DefWindowProcA DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DrawEdge DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextA EnableMenuItem EnableScrollBar EnableWindow EndPaint EnumChildWindows EnumThreadWindows EnumWindows EqualRect FillRect FindWindowA FrameRect GetActiveWindow GetCapture GetClassInfoA GetClassNameA GetClientRect GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetDlgItem GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextA GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetKeyboardType GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuState GetMenuStringA GetMessagePos GetParent GetPropA GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSystemMenu GetSystemMetrics GetTopWindow GetUpdateRect GetWindow GetWindowDC GetWindowLongA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowThreadProcessId InflateRect InsertMenuA InsertMenuItemA IntersectRect InvalidateRect IsChild IsDialogMessageA IsIconic IsRectEmpty IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadBitmapA LoadCursorA LoadIconA LoadKeyboardLayoutA LoadStringA MapVirtualKeyA MapWindowPoints MessageBoxA OemToCharA OffsetRect PeekMessageA PostMessageA PostQuitMessage PtInRect RedrawWindow RegisterClassA RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu RemovePropA ScreenToClient ScrollWindow SendDlgItemMessageA SendMessageA SetActiveWindow SetCapture SetClassLongA SetCursor SetFocus SetForegroundWindow SetMenu SetMenuItemInfoA SetPropA SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongA SetWindowPlacement SetWindowPos SetWindowTextA SetWindowsHookExA ShowCursor ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoA TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnregisterClassA UpdateWindow WaitMessage WinHelpA WindowFromPoint wsprintfA GetSysColor

oleaut32

SafeArrayCreate SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantCopyInd VariantInit

Name

.text

Size

809KB

Virtual Size

812KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

123KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

47KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

67KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

ollydbg/x86eas.hlp

SHA256 d87a22e57bf5d8a35ec50fb8b8d50fe4e0bb5e8f25b2f6c2138cd8b16a4a50b3
MD5 a7ee6910097c209c2e1fb234c1dff996
SHA1 92e27caff224080389e1bd9272cc83040106ea4b
SHA512 f02e23f2fea95a2e2f0113981f0bf2accbaf9d6d8ef5c84014aa54042da7a7030317b7318bfcb10454c12fe3dfe89c19d24e4db820e2d1b3e490e6ed30e301ed
SSDEEP 12288:A5yrIF6CrWIxbUsj3KYmMpLRpb2H5mZKQY52tof3n3J:YkIFTrtjaYLRpb2ZmZKQu/3J
MD5 SHA1 SHA512 SSDEEP

ollypack/OBSIDIUM 1.061 VB ONLY [loveboom].txt

SHA256 4ecbe73bb3b661ecbbb2513c6a6de3e0cf115bd71948182f457bea0e9cf238e0
MD5 2152501fd3cff61a7d4bb47ac21a4a99
SHA1 b29e640ebbe250f7018c291c7c00dfdbe21219fa
SHA512 34c05e87521193ef724ee45b2584e47250268a97ef2d78c097b0cb85c52d23f646e7d31988b849d56180a8f4c4d9fc131bd73bdb2ece17a7cec29d9f7df6f124
MD5 SHA1 SHA512

ollypack/OBSIDIUM 1.1.1.4.txt

SHA256 043e7f50e0c1452d45f71692895f3e888610e1364f578451e288a1cdbd582d78
MD5 95936fe9ee871395a3bc39f3c4bf9a3b
SHA1 342b9fd2498b19fc1c7de68676981e724e58fb26
SHA512 65b1344d5c3d2b8705078d77d6d2bab84aea7044bd5b4f95c91aba1d45b92e85e9e492664a6fa83e723357e078cd5aec958483df93c25e3898674ff5677df806
MD5 SHA1 SHA512

ollypack/Obsidium 1.061 OEP Finder v0.1 (for VB only).txt

SHA256 4ecbe73bb3b661ecbbb2513c6a6de3e0cf115bd71948182f457bea0e9cf238e0
MD5 2152501fd3cff61a7d4bb47ac21a4a99
SHA1 b29e640ebbe250f7018c291c7c00dfdbe21219fa
SHA512 34c05e87521193ef724ee45b2584e47250268a97ef2d78c097b0cb85c52d23f646e7d31988b849d56180a8f4c4d9fc131bd73bdb2ece17a7cec29d9f7df6f124
MD5 SHA1 SHA512

ollypack/Obsidium 1.1.1.4 Unpack (not for VB).txt

SHA256 7f9ffc954ddfee4434c6dfacf3d179a505ed90d857bdde4cb76098104be7133e
MD5 97d1895bf8c329e42f63b993ea292235
SHA1 14f9e84f39fb57e0e6d224e7a483d87fcc32f901
SHA512 993194a67b39fc08b1c65f0abdab03ef3d397276391efeb50d998c29e8da2658893a06500874fb57c35dffe918000594d8e24fc31488496176691022db4faee2
MD5 SHA1 SHA512

ollypack/Obsidium 1.2.5.0 Fix IAT.txt

SHA256 0bb1a668767e431475f4b959dcd55902c4d2b74945a7ef5797a9c67b3c4d60ad
MD5 f319aae2b3d2835e565eb177ab23b874
SHA1 4d65a50e2b202deaf15f007b4bc3160cfac2affd
SHA512 4f52410c078da802d73b412798ea78f1e946701817c757371a482dbd189277cd49b967c2f8399ddba48989b03240ca4e08206ab5538d324a6f47c8b37972ca8c
MD5 SHA1 SHA512

ollypack/Obsidium 1.2.5.0 OEP Finder.txt

SHA256 1dc73f5c710a0bd69dbf0c05d6c1e86f24a59e9b5ea83c7ad23c046c1ca5e554
MD5 ed7782e0b69ec092c8e8ea3968f98f80
SHA1 929916e302e296dafb755a4d96896c5c913f9cc1
SHA512 d772d71ae91337e40510e84e07c9488b8d257b6afdc61fafed6fd387f632ad7dec20e5cdbeb614d40517a1c11aefe52c65509d7ff15ceab6c758c9a09626b8bb
MD5 SHA1 SHA512

ollypack/Obsidium 1.3.0.x OEP Finder + Find Stolen Code + Fix IAT .txt

SHA256 0e0d7e08ba20f98ad340d7d912e53bbc3fcc3937939d3e0e0e2cdf025a8c88a9
MD5 8b4900750e583178384308ee5bcd6abe
SHA1 d959ad6e810ffcaaf560711644f4790755b26fc1
SHA512 7811b2267f4f3aba708540b3475143f4df7a4b346c5a7a68d71bd05bd7ccb25e2808cac30c0c429dc64ac4a149dbba9de2b19caebd64d480e8135e65d48c77c3
SSDEEP 192:uzrwWYJCzJvwSYgJeXkkUIGkSp3ycPdX/AZVCbHmUM:u6JCzJvwSYgJeUkUIGkMvHDmUM
MD5 SHA1 SHA512 SSDEEP

ollypack/Obsidium 1.3.4.2 IAT Repair.txt

SHA256 cd970ec4613a3bb4385a0dea3c51babc8459b28c26bb872c67e4725a596bf391
MD5 a809022f4549e767ccd7d40c6c27b16e
SHA1 7cf6141b5a660e37c20eabd8d152d3f776972249
SHA512 48f2aa5c33eba9b303df17551363e4d5fe26e1ecebd462a5211d7482e9564b6fe2fdb314132716163469c4eb5d3359655bb1bcec6ada0f8b42ba9577415fecf2
MD5 SHA1 SHA512

ollypack/Obsidium 1.3.4.2 OEP Finder (Virtual Protect).txt

SHA256 a7127e5ba316f7fbc98d9da19f064371044b972569cf2641957521901af90455
MD5 eaec74d83b4a42df7281d6f4668c3027
SHA1 7dc96f5fd6abce62403ba22dc6ea696186e3dccb
SHA512 ab18fd9bc626ee45cf816251e181cad73e208ba03c219bf760411d2acb8930da47ab52eed0bf8c803859a3be8da3a4d3a4de37b6995589df1ef2df3c442de05b
MD5 SHA1 SHA512

ollypack/Obsidium 1.3.4.2 OEP Finder.txt

SHA256 91053cacb48d3a573b1262075d203d3262ee3adb13f11716c3c8fb100493da3b
MD5 72cff645c0edd0c7d6c31077dd2d97cc
SHA1 bdb45c70e1c82dd590a0727fa95f6283e2103a7b
SHA512 b3ca00d80f513ef3a74f79448c0cb3e50d345b3768f23ef0adf79e921bf12d54c8f0358c6daf27c1e4c8ba236375ede7cead171da9eb09daf7d8b9d9bd300de9
MD5 SHA1 SHA512

ollypack/Obsidium 1.3.x.x Unpacking Script.txt

SHA256 1a2099e6fb6bb923baac5569f8d6ba1d5af31165ef1abce36e7ffba5c845ed01
MD5 ffcce2943976e69a9b258f824d09d8f6
SHA1 056b7db3e49affb41ff02f4e997c14ef3b392bec
SHA512 35b2ebd565e9e57c44b184608c7637088c35af24321ace8609215ac50dd4b04197ec979a961d8a01ae3216adbf4abc44e7942ec8af09919193416b4240871157
SSDEEP 192:OwEfX5ek95vZaReeL+qLO7EM8p95Wzb30M6I2jBf7L/izmLS:vkPsReeL+7RAPWP30M6I2jBf7L/izES
MD5 SHA1 SHA512 SSDEEP

ollypack/Obsidium 1.4.x.x OEP Finder + IAT Repair v0.2.txt

SHA256 19f7bb40cda541351f7d9251dcc7daf3f528c3c6bffd42cbd0f093b9d23cd96a
MD5 143e3aa5e7a4fcf11fbed95c6e4c79aa
SHA1 322070f82599225f1be4145ea2ce9c9e1ebcdf1c
SHA512 8d2dfc56a9bb3680a60206559325c369de7d3dc08343ec335fe89bef170d330ead4c345258140b691c9701ef8d86942db031911a1f3023b4d7de179a3a3b9a84
MD5 SHA1 SHA512

ollypack/Obsidium114.txt

SHA256 53b8bd4dadbc14887c7ce63fa0d73edf641110ee382e6e816fece95c12b7f47a
MD5 21b52d3516e605c36df7af6e57229f3e
SHA1 8444ca304497cf85a733dadea892cbe72aab9476
SHA512 7b3258eb78ccd4511e3340725f91b3c7673a53006e4cebecba371f1f5471ce833a18871c6553f47ebb5e9a3f1bfd0c9d3b79858f76fd25b3522379ba13936313
MD5 SHA1 SHA512

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

echo.7z

1058352281.exe

kernel32

user32

advapi32

mscoree

comctl32

shell32

generic

echo/EchoMirage.chm

echo/EchoMirage.exe

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

ole32

comctl32

shell32

shfolder

comdlg32

wsock32

msvcrt

winspool.drv

oleacc

winmm

gdiplus

ntdll

generic

echo/EchoMirageHooks32.dll

oleaut32

advapi32

user32

kernel32

wsock32

generic

echo/EchoMirageHooks64.dll

oleaut32

advapi32

user32

kernel32

wsock32

ntdll

generic

echo/EchoMirageUnelevated.exe

oleaut32

advapi32

user32

kernel32

shell32

generic

echo/License.txt

echo/unins000.dat

echo/unins000.exe

generic

ollydbg/OllyDbg.exe

generic

ollydbg/OllyDbg.hlp

ollydbg/OllyPath.dll

kernel32

msvcrt

generic

ollydbg/Patches/OllyPath_mod.rar

OllyPath.cbp

bin/OllyPath.dll

kernel32

msvcrt

generic

main.cpp

main.h

ollydbg/Patches/patches.txt

ollydbg/Patches/plugin_patches.txt